diff --git a/CHANGELOG.md b/CHANGELOG.md
index 05f03e9..58ad5b1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,38 @@ All notable changes to `difflock` are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and the
 project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## 0.3.0 - 2026-08-11
+
+### Added
+
+- **`difflock:report`** writes the whole run — drift and findings — to a self-contained HTML file, for pull requests and CI artifacts. No external stylesheet, font or script, because an artifact opened from a `file://` URL has no network. Everything in it is escaped: table and column names come from your database, not from this package. `--format=json` writes the same document `difflock:check` emits.
+- **Secret-shaped column defaults are flagged before they reach git.** `difflock:diff --save` recognises published credential prefixes (`sk_live_`, `ghp_`, `AKIA`, `AIza`, `-----BEGIN`, …), URLs carrying `user:pass@`, `password=`-style connection strings, and long generated-looking values. It warns and never blocks — these are shapes, not certainties — and is tuned to stay silent on ordinary defaults so the warning keeps its meaning.
+- **Progress feedback** while the schema is read, on a decorated terminal only. A CI log has no cursor and a JSON document must not gain a line.
+
+## 0.2.1 - 2026-08-11
+
+### Added
+
+- **`unindexed-foreign-key`** catches the most common Laravel/PostgreSQL performance bug: PostgreSQL creates no index for the column a foreign key points *from*, and MySQL does. Engine-aware — silent where the engine handles it, and it names the engine it is actually talking about.
+- **`redundant-index`** flags an index a longer one already covers. Only the leading-prefix case, because only that one is certain.
+- **`drop-index` now judges on evidence rather than hedging.** It reads the engine's own counters — `pg_stat_user_indexes` on PostgreSQL, `performance_schema` on MySQL — so an index nothing has read in 274 days is reported at low and one serving 2.1M reads at high. The window is quoted with every number, and the caveats (counters are per instance, a short window proves nothing) are repeated rather than rounded off. Read counts can never soften a dropped *constraint*.
+
+### Changed
+
+- A check now reads the schema **once** rather than once for drift and again for the rules — measured at 598 queries and 3.7s on a 99-table PostgreSQL database before the change. Locked in by a regression test rather than a one-off measurement.
+
+## 0.2.0 - 2026-08-11
+
+### Added
+
+- **`difflock:doctor`** reports what Difflock can see: connection, driver, version, reachability, table and migration counts, registered rules, and where the baseline and accepted-findings files live. Its central line is **privileges** — it opens a transaction, attempts the cheapest possible write and rolls back, then says whether the role Difflock connects as *could* write. That turns "Difflock never writes" from a claim about code into something checkable about your role.
+- **`sensitive-column`** flags columns whose names suggest payment data, government identifiers or credentials. Deliberately silent on `password` and `remember_token`, which every Laravel application has — a rule that fires on the framework's own starter migration teaches people to ignore security rules.
+- **Dropped audit trails** are called out in `drop-table`. A sentence, never a level, so a false positive costs prose rather than a blocked deploy.
+
+### Changed
+
+- The overview command no longer reprints the entire findings list.
+
 ## 0.1.0 - 2026-08-10
 
 First release. Deliberately `0.x`: the public API is documented and tested, but
@@ -51,4 +83,7 @@ contracts to settle before 1.0 rather than after it.
 
 - **`unindexed-foreign-key`** catches the most common Laravel/PostgreSQL performance bug — PostgreSQL creates no index for the column a foreign key points from, and MySQL does. The rule is engine-aware and says nothing where the engine handles it.
 
+[0.3.0]: https://github.com/Heyosseus/difflock/releases/tag/v0.3.0
+[0.2.1]: https://github.com/Heyosseus/difflock/releases/tag/v0.2.1
+[0.2.0]: https://github.com/Heyosseus/difflock/releases/tag/v0.2.0
 [0.1.0]: https://github.com/Heyosseus/difflock/releases/tag/v0.1.0