v1.2.0

What's Changed

• ci: auto-generate release notes by @Trozz in #16
• fix: UI/UX audit - accessibility, focus rings, touch targets, reduced motion by @Trozz in #17
• fix: polish reveal page design by @Trozz in #18
• fix: theme toggle not working (script terminated early) by @Trozz in #19
• fix: theme toggle using CSS icon switching by @Trozz in #20
• fix: light theme not applying (CSS quote escaping) by @Trozz in #21
• fix: light mode polish and collapsible advanced options by @Trozz in #22
• fix: API docs empty paths, update README by @Trozz in #23
• fix: hide DELETE endpoint from public API docs by @Trozz in #24
• fix: protect DELETE endpoint from blind deletion by @Trozz in #25
• feat: rate limiting setup script for WAF rules by @Trozz in #26

Full Changelog: v1.1.0...v1.2.0

v1.1.0

What's New

Features

• Title field -- optional context label shown to recipients before reveal ("Database credentials for staging")
• Dark/light theme toggle -- defaults to system preference, manual override persisted in localStorage
• Burn confirmation animation -- smooth fade transition when revealing secrets
• Custom burn message -- sender sets a message shown after the note is destroyed
• Configurable view count -- non-password notes can be viewed 1-5 times before burning (default 1)
• Usage stats -- counter at /api/stats, shown on create page ("N secrets shared securely")
• IP restriction -- limit note access to specific IPv4/IPv6 addresses or CIDR ranges
• Copy secret button -- one-click copy of the revealed plaintext
• Enter key submission -- pressing Enter in the password field triggers reveal

Security

• Fixed race condition on non-password note retrieval (was doing two KV reads, now single atomic getAndDeleteNote)
• Fixed TTL reset on password attempts (stores absolute expiration, preserves original TTL)
• Fixed XSS vectors in inline scripts (JSON.stringify for interpolated values)
• Proper x-forwarded-for parsing (first IP from comma-separated list)
• UUID validation on reveal page route

Code Quality

• 59 tests (up from 20 in v1.0.0)
• Typed middleware (MiddlewareHandler instead of any)
• Added package.json scripts (dev, test, typecheck, deploy)
• Accessibility improvements (aria-label, focus-visible on theme toggle)
• CSP-compliant styling (no inline style attributes)

CLI

Download gremlin-secret.sh or the Rust binary for your platform from the assets below.

v1.0.0

Initial Release

Zero-knowledge, one-time secret sharing powered by Cloudflare Workers.

Features

• Client-side AES-256-GCM encryption -- secrets are encrypted in the browser before storage. The server never sees decryption keys.
• Burn-before-return -- non-password notes are deleted from KV before the response is sent.
• Password protection -- optional second factor via PBKDF2-SHA-256 (600,000 iterations) with 3 decryption attempts before auto-burn.
• Configurable TTL -- 1 hour, 24 hours, 1 week (default), or 30 days with KV native expiration.
• API-first -- JSON API with OpenAPI 3.1 docs via Scalar at /api/docs.
• POST / alias -- curl -d '{"c":"...","iv":"..."}' https://secure.gremlin.group/ for easy scripting.
• CLI tools -- POSIX shell script and Rust binary for scripted secret creation.
• Gremlin-branded dark UI -- create and reveal pages with inline Hono JSX.

CLI

Download gremlin-secret.sh or the Rust binary for your platform from the assets below.

echo "my-secret" | ./gremlin-secret.sh
echo "my-secret" | gremlin-secret --password