diff --git a/CHANGELOG.md b/CHANGELOG.md
index 1b06b74..e92ed7b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,35 @@ All notable changes to this project will be documented in this file.
The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-## [1.1.0] - Unreleased
+## [1.2.0] - Unreleased
+
+### Added
+- Multi-category support with parent/child hierarchy (#1)
+- Categories admin CRUD — list, edit, color picker, custom marker icon
+- Location-category junction table (many-to-many)
+- Categories tab on location edit form (multi-select)
+- Category filtering on site frontend (`catid` parameter)
+- Custom map markers per category — SVG/PNG icon support (#2)
+- Map module JOINs category data for marker icons and colors
+- `access.xml` with full Joomla ACL permissions (#30)
+- SQL update schema with `sql/updates/mysql/` versioned files (#31)
+- REST API via Web Services plugin (`plg_webservices_mokosuitestorelocator`) (#29)
+- API controller + JSON:API view for locations CRUD at `/api/v1/mokosuitestorelocator/locations`
+- `LocationBridgeHelper` — static helper for cross-extension integration (#48)
+- `LocationSavedEvent` — fires `onStoreLocatorLocationSaved` for cache invalidation
+- Plugin added to package manifest
+
+### Changed
+- Map module dispatcher uses aliased table queries with category JOIN
+- ORDER BY clauses in admin and site models now validated against filter_fields allowlist
+
+### Security
+- CSV import: MIME type validation, 2 MB file size limit, delimiter allowlist (#34)
+- CSV import: formula injection prevention (strips leading `=+\-@\t\r` characters)
+- ORDER BY injection prevention — replaced `$db->escape()` with allowlist validation
+- Map module: `$mapHeight` CSS value validated with regex pattern
+
+## [1.1.0] - 2026-06-23
### Added
- Haversine proximity search — filter locations by distance from user's coordinates
@@ -18,6 +46,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
- CSV import: auto-detect column headers (title/name/store, address/street, city, etc.)
- CSV import: per-row validation via LocationTable::bind()->check()->store()
- CSV import view accessible from admin toolbar and submenu
+- FocalPoint (Shack Locations) migration import
- Language strings for directions, geocoding feedback, and import UI
## [01.00.00] - 2026-06-23
diff --git a/README.md b/README.md
index 4d997c6..d64748d 100644
--- a/README.md
+++ b/README.md
@@ -9,6 +9,7 @@ A Joomla 4/5 package providing a store locator listing component with coordinati
| Store Locator Component | component | `com_mokosuitestorelocator` |
| Store Locator Map | module (site) | `mod_mokosuitestorelocator_map` |
| Store Locator Search | module (site) | `mod_mokosuitestorelocator_search` |
+| Web Services API | plugin (webservices) | `plg_webservices_mokosuitestorelocator` |
## Requirements
@@ -27,7 +28,9 @@ A Joomla 4/5 package providing a store locator listing component with coordinati
### Implemented
- **Admin CRUD** — full location management with tabbed edit form (details, address, coordinates, contact, image)
- **Admin list** — searchable, filterable, sortable locations list with bulk publish/unpublish/delete
-- **Site frontend** — locations list and detail views with pagination
+- **Multi-category** — categories with parent/child hierarchy, color, custom marker icons, many-to-many assignments
+- **Custom map markers** — per-category SVG/PNG marker icons on the Leaflet map
+- **Site frontend** — locations list and detail views with pagination and category filtering
- **Schema.org** — LocalBusiness structured data markup on all frontend templates
- **SEF URLs** — router with menu, standard, and nomenu rules
- **Menu items** — "All Locations" list and single "Location Detail" picker
@@ -37,13 +40,18 @@ A Joomla 4/5 package providing a store locator listing component with coordinati
- **Get Directions** — Google Maps directions link on detail page and map popups
- **Auto-geocoding** — coordinates auto-populated from address on save (Nominatim/OSM)
- **CSV import** — bulk-create locations from spreadsheet with auto-detected column mapping
+- **FocalPoint migration** — one-click import from Shack Locations / FocalPoint
+- **REST API** — JSON:API endpoints via Joomla Web Services plugin
+- **ACL permissions** — `access.xml` with standard Joomla permission actions
+- **SQL update schema** — versioned migration files for safe upgrades
+- **Shop integration** — `LocationBridgeHelper` for cross-extension data access, `LocationSavedEvent` for cache invalidation
+- **Security hardening** — CSV injection prevention, MIME validation, ORDER BY allowlists, input sanitization
### Planned
-- Marker clustering for dense location areas
-- Multi-category support with custom map markers
-- ACL permissions and SQL upgrade schema
-- REST API via Joomla Web Services plugin
-- MokoSuiteShop integration for multi-store ecommerce
+- Marker clustering for dense location areas (Leaflet.markercluster)
+- Google Maps provider as alternative to Leaflet
+- CSV export
+- Photo gallery per location
## Development
diff --git a/source/packages/com_mokosuitestorelocator/access.xml b/source/packages/com_mokosuitestorelocator/access.xml
new file mode 100644
index 0000000..74c1a43
--- /dev/null
+++ b/source/packages/com_mokosuitestorelocator/access.xml
@@ -0,0 +1,12 @@
+
+