Not every release is a feature release.
v1.2.2 has zero new audio tools. No new analysis. Nothing to show off in a demo. What it has is a development process we’re no longer embarrassed by.
Phantom runs on your local machine with access to your audio files. That’s what makes it useful, and it’s exactly why the codebase has to be clean. Before we push it further, we needed to make sure we weren’t leaking things we shouldn’t: credentials, internal docs, or audio files that have no business in a git repo.
What we added
Pre-commit framework with gitleaks. Every commit now runs secret scanning. API keys, tokens, credentials: caught before they ever touch the repo. gitleaks handles the heavy lifting; we just wired it in.
PII detection hook. A custom hook that blocks commits containing personal information or absolute paths. Absolute paths are a surprisingly common footgun. They look harmless in a diff, but they expose your local directory structure and can cause subtle bugs when someone else runs the code on a different machine.
Large binary hook. Audio files over 1MB are blocked from being committed. This matters more than it sounds. A WAV file accidentally committed to git history lives there forever unless you rewrite the entire repo. The hook catches it early.
Planning docs hook. Internal .planning/ docs (roadmaps, phase notes, design decisions) are now blocked from leaving the repo. Useful internally. No place in a public release.
GitHub Actions security scan. CI now runs a security scan on every push. The pre-commit hooks catch most things locally. CI is the safety net when someone skips them.
Extended .gitignore. Common credential file patterns added. Belt and suspenders.
We also fixed a version string drift that was causing Phantom to report the wrong version, added path validation to phantom render to prevent path traversal, and restored pytest to the pre-push hook so we can’t accidentally ship a broken build.
Why this matters
Audio engineers work with files that are personal, sometimes commercial, often under NDA. They shouldn’t have to think about whether the tool analyzing those files is itself a liability.
This doesn’t make for exciting release notes. It had to happen anyway.
Update via pip or check the changelog on GitHub.