Scrub location/IP from public assets; add gitleaks pre-commit hook

- README: replace real lat/lon in the config example with 0.0/0.0 and
  drop the city name from the screenshot caption
- viewer screenshot: re-captured with the receiver IP masked
- add .pre-commit-config.yaml running gitleaks to block secrets from
  reaching gitea or the public GitHub mirror

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/FUNDING.yml

@@ -0,0 +1 @@
+buy_me_a_coffee: adsbit

.github/dependabot.yml

@@ -0,0 +1,17 @@
+version: 2
+updates:
+  # Keep GitHub Actions pinned versions current.
+  - package-ecosystem: github-actions
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "ci"
+
+  # Keep Python dependencies current.
+  - package-ecosystem: pip
+    directory: "/"
+    schedule:
+      interval: weekly
+    commit-message:
+      prefix: "deps"

.github/workflows/codeql.yml

@@ -0,0 +1,35 @@
+name: CodeQL
+
+# Static security analysis (free for public repositories). Scans the Python
+# backend and the vanilla-JS frontend on pushes, PRs, and weekly.
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: "23 5 * * 1"
+
+jobs:
+  analyze:
+    name: Analyze (${{ matrix.language }})
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      contents: read
+      actions: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [python, javascript]
+    steps:
+      - uses: actions/checkout@v4
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - name: Analyze
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

.github/workflows/release.yml

@@ -7,6 +7,12 @@ name: Release
 on:
   push:
     tags: ["v*"]
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Image tag to publish (e.g. 1.1.2); leave blank for just :latest"
+        required: false
+        default: ""
 
 permissions:
   contents: read
@@ -40,6 +46,7 @@ jobs:
           tags: |
             type=semver,pattern={{version}}
             type=semver,pattern={{major}}.{{minor}}
+            type=raw,value=${{ inputs.version }},enable=${{ github.event_name == 'workflow_dispatch' && inputs.version != '' }}
             type=raw,value=latest
 
       - name: Build and push

.gitignore

@@ -17,8 +17,9 @@ __pycache__/
 .claude/
 CLAUDE.md
 
-# Gitea token
-.gitea-token
+# Local secrets / tokens
+*.token
+.git-credentials
 
 # OS
 .DS_Store

.pre-commit-config.yaml

@@ -0,0 +1,14 @@
+# Pre-commit hooks for ADS-Bit.
+#
+# Setup (once):
+#   pip install pre-commit
+#   pre-commit install
+#
+# Thereafter gitleaks scans every commit for secrets (tokens, keys,
+# password hashes) before they can reach gitea or the public GitHub mirror.
+# Run manually across the whole tree with:  pre-commit run --all-files
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.18.4
+    hooks:
+      - id: gitleaks

CHANGELOG.md

@@ -4,6 +4,18 @@ All notable changes to this project are documented here. The format is based
 on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
 [Semantic Versioning](https://semver.org/).
 
+## [1.1.2] - 2026-06-10
+
+First release with a published container image and security tooling. No
+application behavior changes from 1.1.1.
+
+### Added
+- Prebuilt multi-arch (amd64 + arm64) container image published to GitHub
+  Container Registry: `ghcr.io/allennpit/ads-bit`.
+- CodeQL code-scanning workflow (Python + JavaScript) and Dependabot updates
+  for GitHub Actions and pip.
+- `workflow_dispatch` trigger on the release workflow for manual image builds.
+
 ## [1.1.1] - 2026-06-10
 
 ### Added
@@ -43,6 +55,7 @@ on [Keep a Changelog](https://keepachangelog.com/), and this project adheres to
   pixel-art sprites, directional backgrounds, weather, sun/moon, admin panel,
   first-run setup wizard, and Docker/Podman support.
 
+[1.1.2]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.2
 [1.1.1]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.1
 [1.1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.1.0
 [1.0]: https://github.com/AllenNPIT/ADS-Bit/releases/tag/v1.0

README.md

@@ -6,7 +6,19 @@
 
 A retro SNES-style side-view flight tracker that displays ADS-B aircraft data with custom pixel art sprites.
 
-![ADS-Bit Screenshot](screenshots/screenshot.png)
+## Screenshots
+
+### Live viewer
+
+Real-time ADS-B traffic rendered as pixel-art sprites over a directional background — here the East view, with a desert skyline on the horizon. Aircraft are labelled with callsign, altitude, and distance, and listed in the sidebar sorted by range.
+
+![Live viewer with aircraft in view](screenshots/viewer.png)
+
+### In-app pixel editor
+
+Draw and edit aircraft sprites directly in the browser: pencil, eraser, line/rectangle/ellipse shapes, fill bucket, select & move, zoom/pan, undo/redo, custom palettes, and an adjustable reference overlay. Saving uploads the sprite back to the running tracker — no external tools needed.
+
+![In-browser pixel sprite editor](screenshots/pixel-editor.png)
 
 ## Features
 
@@ -27,7 +39,7 @@ A retro SNES-style side-view flight tracker that displays ADS-B aircraft data wi
 
 ```bash
 # Clone the repository
-git clone https://gitea.chops.one/allen/ADS-Bit.git
+git clone https://github.com/AllenNPIT/ADS-Bit.git
 cd ADS-Bit
 
 # Install dependencies

server.py

@@ -17,7 +17,7 @@ from aiohttp import web, ClientSession, ClientTimeout
 import netifaces
 import bcrypt
 
-VERSION = "1.1.1"
+VERSION = "1.1.2"
 
 WEB_DIR = Path(__file__).parent
 # Config path is overridable (handy for containers persisting config on a