4.1.0

Security Hardening

Improved

• Serverless SSE stability — locked down persistent update listeners (.on('value')) to look up strictly targeted author resources instead of listening to the global database root, completely forgetting cascade server crashes under traffic spikes.

Security

• Removed executeJavaScript Deep Link vulnerability — eliminated a critical Remote Code Execution (RCE) and XSS vulnerability by removing risky executeJavaScript string evaluations of untrusted external protocol variables, routing incoming payload structures natively over isolated IPC channels (webContents.send).
• Enforced server-side data authority — stripped out client-controlled author profile strings from the config creation payload, ensuring user identity fields are built securely on the server from verified session states rather than trusting raw JSON body inputs.
• Secured analytic mutations against spoofing — re-engineered telemetry and download increment handlers to securely check document existence before execution, preventing malicious fake ID injections from spawning rogue orphan data structures inside database trees.
• Hardened download metric protections — restricted clients from spoofing initial document engagement metrics by forcing all new configuration structures to securely initialize at zero downloads explicitly on the backend layer.