Service Business Management Software: Zorderz 1.6.1 Hardens Security and Guards Contributions

A security release.

Zorderz 1.6.1 closes five hardening gaps found in a full security review and, because Zorderz is open source and takes outside contributions, adds an automated guardrail suite whose job is to stop a future "bug fix that is really an exploit" (the hypocrite commit pattern that hit xz utils in 2024) from ever landing. There are no behavior changes for legitimate users. Everything here either removes a way to leak or abuse data, or makes a security regression fail the build.

What got hardened: the Company Data export now excludes secrets three ways, by name, by suffix, and by redacting secret values wherever they are nested, so a credential can never travel in an export. Magic link OTP login takes the user id only from the server side and adds rate limiting keyed on the real client address. Non privileged KPI views strip revenue and fail closed. The knowledge app serves files with a nosniff header and a safe disposition. The kiosk PIN locks out after repeated wrong tries.

What guards the future: a hypocrite commit sentinel scans every pull request diff for the dangerous edits and fails the build, a security unit suite pins the invariants that must never regress (19 tests, 77 assertions), and branch protection on main now requires those checks and a code owner review before anything merges.

Lockstep release: Zorderz Core theme 1.6.1 and Zorderz Apps 1.6.1.

Full changelog: https://github.com/CarletonTorpin/Zorderz/blob/main/CHANGELOG.md