Haydi 1.2.1
Security release.
- The REST and MCP API (
/wp-json/haydi/v1/*) now requires a valid Bearer token on every request; the fallback to logged-in-user capability checks has been removed. Provision a token from the Haydi settings page to use the API. - Haydi's admin page, audit log, and chat access default back to Administrators only (
manage_options). Sites that want to grant access to other roles can use thehaydi_access_capabilityfilter; the Editor model restriction setting is preserved.