v1.1.0

What's New

Features

• Title field -- optional context label shown to recipients before reveal ("Database credentials for staging")
• Dark/light theme toggle -- defaults to system preference, manual override persisted in localStorage
• Burn confirmation animation -- smooth fade transition when revealing secrets
• Custom burn message -- sender sets a message shown after the note is destroyed
• Configurable view count -- non-password notes can be viewed 1-5 times before burning (default 1)
• Usage stats -- counter at /api/stats, shown on create page ("N secrets shared securely")
• IP restriction -- limit note access to specific IPv4/IPv6 addresses or CIDR ranges
• Copy secret button -- one-click copy of the revealed plaintext
• Enter key submission -- pressing Enter in the password field triggers reveal

Security

• Fixed race condition on non-password note retrieval (was doing two KV reads, now single atomic getAndDeleteNote)
• Fixed TTL reset on password attempts (stores absolute expiration, preserves original TTL)
• Fixed XSS vectors in inline scripts (JSON.stringify for interpolated values)
• Proper x-forwarded-for parsing (first IP from comma-separated list)
• UUID validation on reveal page route

Code Quality

• 59 tests (up from 20 in v1.0.0)
• Typed middleware (MiddlewareHandler instead of any)
• Added package.json scripts (dev, test, typecheck, deploy)
• Accessibility improvements (aria-label, focus-visible on theme toggle)
• CSP-compliant styling (no inline style attributes)

CLI

Download gremlin-secret.sh or the Rust binary for your platform from the assets below.