Releases · AloneDay-91/Layera

Changes since v1.1.0

fix(security): serve stored bytes under the type the server recorded (f4b9f3c)
fix(security): stop shipping a localhost auth URL to browsers (575677d)
fix(security): hide items shared with a former workspace member (dec5fbf)
fix(security): require Secure session cookies in production (c581749)
fix(security): keep the tightened headers from breaking previews (35188fd)
fix(security): sandbox PDF previews, tighten markdown sanitising, document env (e88974c)
fix(security): sweep stale rate limit rows (4a003ee)
fix(security): stop logging OTPs and require a verified email to self-promote (b55cbe6)
fix(security): confirm organization membership before joining a team workspace (6613586)
fix(security): add a nonce-based CSP and validate the session in the shell (2ad5285)
fix(security): validate avatar bytes and trust stored item types (814cfc1)
fix(security): close the archive and upload paths around MIME and quota rules (01c7c11)
fix(security): reject unsafe item names and neutralise zip entry paths (0967f1b)
fix(security): keep internal shares under the item owner's control (4d717b3)
fix(security): invalidate share unlock cookies when the password changes (fce62b7)
fix(security): stop trusting client proxy headers and compare the cron secret safely (368024d)

ci: tag each green main push and list changes since the last release (42d1a18)
Remove the marketing site from the self-host repository. (6273be1)
Add a public marketing site and deploy it on Dokploy. (f1f068d)
Merge pull request #4 from AloneDay-91/cursor/security-audit-followups-8b18 (4406475)
Merge branch 'main' into cursor/security-audit-followups-8b18 (d75070e)
Add a Dokploy Compose file so production builds on the server. (556024f)
Merge pull request #3 from AloneDay-91/cursor/security-audit-hardening-8b18 (46d630a)
docs: document every runtime env var and bootstrap ADMIN_EMAILS (00e12b8)

Audit de sécurité : durcissement de l'authz, des partages, des uploads et des en-têtes by @AloneDay-91 in #3
Sécurité : le type de contenu servi depuis le stockage était choisi par le client by @AloneDay-91 in #4

Full Changelog: v1.1.0...v1.1.1