diff --git a/CHANGELOG.md b/CHANGELOG.md
index 7722f6c..a0a8923 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.18.3] - 2026-09-30
+
+### Fixed
+
+- **Hidden-path tripwires catch obfuscated scans.** `TripwireRule` matched the raw request path, so a scan dressed up as `//.env`, `/%2Eenv`, `/%252Eenv` or `/static/..%2f.git/config` slipped past while a webserver still resolved it to the decoy path. The path is now canonicalized before matching (drop query/fragment, ASCII percent-decode, collapse duplicate slashes, resolve `.`/`..`), and configured decoy paths are canonicalized the same way.
+
 ## [0.18.2] - 2026-09-29
 
 ### Fixed
diff --git a/package-lock.json b/package-lock.json
index 70afc6b..48f5d66 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -10407,7 +10407,7 @@
     },
     "packages/client": {
       "name": "@webdecoy/client",
-      "version": "0.18.2",
+      "version": "0.18.3",
       "license": "MIT",
       "devDependencies": {
         "@types/jest": "^29.5.11",
@@ -10424,10 +10424,10 @@
     },
     "packages/express": {
       "name": "@webdecoy/express",
-      "version": "0.18.2",
+      "version": "0.18.3",
       "license": "MIT",
       "dependencies": {
-        "@webdecoy/node": "^0.18.2"
+        "@webdecoy/node": "^0.18.3"
       },
       "devDependencies": {
         "@types/express": "^4.17.21",
@@ -10448,10 +10448,10 @@
     },
     "packages/fastify": {
       "name": "@webdecoy/fastify",
-      "version": "0.18.2",
+      "version": "0.18.3",
       "license": "MIT",
       "dependencies": {
-        "@webdecoy/node": "^0.18.2",
+        "@webdecoy/node": "^0.18.3",
         "fastify-plugin": "^4.5.1"
       },
       "devDependencies": {
@@ -10472,10 +10472,10 @@
     },
     "packages/hono": {
       "name": "@webdecoy/hono",
-      "version": "0.18.2",
+      "version": "0.18.3",
       "license": "MIT",
       "dependencies": {
-        "@webdecoy/node": "^0.18.2"
+        "@webdecoy/node": "^0.18.3"
       },
       "devDependencies": {
         "@types/jest": "^29.5.11",
@@ -10495,10 +10495,10 @@
     },
     "packages/nextjs": {
       "name": "@webdecoy/nextjs",
-      "version": "0.18.2",
+      "version": "0.18.3",
       "license": "MIT",
       "dependencies": {
-        "@webdecoy/node": "^0.18.2"
+        "@webdecoy/node": "^0.18.3"
       },
       "devDependencies": {
         "@types/jest": "^29.5.11",
@@ -10518,7 +10518,7 @@
     },
     "packages/webdecoy": {
       "name": "@webdecoy/node",
-      "version": "0.18.2",
+      "version": "0.18.3",
       "license": "MIT",
       "devDependencies": {
         "@types/jest": "^29.5.11",
diff --git a/packages/client/package.json b/packages/client/package.json
index 2cc387c..0dc5c39 100644
--- a/packages/client/package.json
+++ b/packages/client/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/client",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "Web Decoy browser widget - signal collection, proof-of-work, and captcha UI",
   "main": "./dist/index.js",
   "module": "./dist/index.mjs",
diff --git a/packages/express/package.json b/packages/express/package.json
index b0ef4e0..f5ff632 100644
--- a/packages/express/package.json
+++ b/packages/express/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/express",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "Web Decoy middleware for Express.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -40,7 +40,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.18.2"
+    "@webdecoy/node": "^0.18.3"
   },
   "peerDependencies": {
     "express": "^4.18.0 || ^5.0.0"
diff --git a/packages/fastify/package.json b/packages/fastify/package.json
index 92b7a74..34d3b8d 100644
--- a/packages/fastify/package.json
+++ b/packages/fastify/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/fastify",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "Web Decoy plugin for Fastify",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -40,7 +40,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.18.2",
+    "@webdecoy/node": "^0.18.3",
     "fastify-plugin": "^4.5.1"
   },
   "peerDependencies": {
diff --git a/packages/hono/package.json b/packages/hono/package.json
index 326c093..b936fe0 100644
--- a/packages/hono/package.json
+++ b/packages/hono/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/hono",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "Web Decoy middleware for Hono — Cloudflare Workers, Bun, Deno, Node",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -44,7 +44,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.18.2"
+    "@webdecoy/node": "^0.18.3"
   },
   "peerDependencies": {
     "hono": "^4.0.0"
diff --git a/packages/nextjs/package.json b/packages/nextjs/package.json
index 5610b28..1d95ee9 100644
--- a/packages/nextjs/package.json
+++ b/packages/nextjs/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/nextjs",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "Web Decoy middleware for Next.js",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -42,7 +42,7 @@
     "url": "https://github.com/WebDecoy/node/issues"
   },
   "dependencies": {
-    "@webdecoy/node": "^0.18.2"
+    "@webdecoy/node": "^0.18.3"
   },
   "peerDependencies": {
     "next": ">=13.0.0"
diff --git a/packages/webdecoy/package.json b/packages/webdecoy/package.json
index 6687726..b858734 100644
--- a/packages/webdecoy/package.json
+++ b/packages/webdecoy/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@webdecoy/node",
-  "version": "0.18.2",
+  "version": "0.18.3",
   "description": "Web Decoy SDK for Node.js - Bot detection with TLS fingerprinting",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",