diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4532f2..cd17b30 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -12,6 +12,18 @@ reproducing 70+ versions of notes.
 
 ## [Unreleased]
 
+### Fixed
+- Harden judge-model URL validation against a hostname prefix bypass
+  (`http://localhost.attacker.com`) — `GateTask._valid_judge_url` /
+  `_parse_judge_url` now use `urllib.parse.urlparse` + hostname checks instead
+  of `startswith`. Closes #283
+  ([#288](https://github.com/MakazhanAlpamys/Soup/pull/288) by [@CODING-DARSH](https://github.com/CODING-DARSH)).
+- `SFTTrainerWrapper` now applies configured vocabulary expansion
+  (`data.add_new_tokens` / `data.new_special_tokens`) and resizes the model
+  embeddings during initialization — previously these fields were accepted by
+  the schema but silently ignored. Closes #289
+  ([#287](https://github.com/MakazhanAlpamys/Soup/pull/287) by [@CODING-DARSH](https://github.com/CODING-DARSH)).
+
 ## [0.71.26] - 2026-07-01
 
 ### Added
diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md
index ef9a07a..ed3cc5c 100644
--- a/CONTRIBUTORS.md
+++ b/CONTRIBUTORS.md
@@ -44,6 +44,9 @@ Listed by first contribution. PR numbers link the work.
   - Unit tests for the `warmup.py` auto-warmup-steps helper ([#274](https://github.com/MakazhanAlpamys/Soup/pull/274))
 - **Kondamwar Akshaya Shrikant** ([@Akshaya-reddy18](https://github.com/Akshaya-reddy18))
   - Friendlier error messages — richer CUDA-OOM hint + Hugging Face gated-repo and `trust_remote_code` mappings + tests ([#282](https://github.com/MakazhanAlpamys/Soup/pull/282))
+- **Darsh** ([@CODING-DARSH](https://github.com/CODING-DARSH))
+  - Harden judge-URL validation against hostname prefix bypass (`startswith` → `urlparse`) in `eval/gate.py` ([#288](https://github.com/MakazhanAlpamys/Soup/pull/288))
+  - Apply configured vocabulary expansion (`data.add_new_tokens` / `new_special_tokens`) during SFT trainer init ([#287](https://github.com/MakazhanAlpamys/Soup/pull/287))
 
 ---