SabHaven v1.2.0 — Legal, privacy and account controls

SabHaven v1.2.0 adds the hosted-service legal, privacy, account-control, and error-state framework.

Added

• Privacy Policy, Terms of Service, Acceptable Use, abuse-reporting, security, and contact pages.
• Versioned Terms acceptance during invite-only registration with server-timestamped acceptance records.
• Signed-in account-data export and automated account deletion for eligible non-owner accounts.
• Custom 403, 404, 410, and application-error screens.
• RFC 9116-style security.txt contact metadata.
• Repository copies of Privacy, Terms, and Acceptable Use policies.

Security and privacy

• Account deletion removes owned Storage objects before deleting the Auth account.
• Automated deletion cannot remove the single owner account.
• Account tools require authenticated user JWTs and independently resolve the caller.
• Members can read only their own invite-redemption history.
• Hosted responses include CSP, HSTS, frame denial, MIME-sniffing protection, referrer policy, and restrictive browser permissions.
• Registration distinguishes contractual Terms acceptance from acknowledgement of the Privacy Policy.

Self-hosting

Self-hosters should deploy the new migrations and account-tools Edge Function and replace the hosted-service legal documents with policies appropriate to their own deployment.

See CHANGELOG.md for the full change summary.

SabHaven v1.1.1 — First documented open-source release

SabHaven v1.1.1 is the first formally documented open-source release of the project.

Highlights

• Invite-only file delivery with public downloads and owner-isolated private storage.
• Supabase Auth, Postgres RLS, Storage RLS, and short-lived signed download URLs.
• Role-aware owner/admin/member administration and invitation controls.
• Hardened private-folder ancestry and reserved-upload authorization.
• Role-aware upload-size enforcement with an owner exemption bounded by Supabase project limits.
• MIT licensing, self-hosting documentation, contribution guidance, security policy, CI, CODEOWNERS, issue templates, and Dependabot.

Self-hosting

See README.md for the Supabase setup, migrations, Edge Function deployment, environment variables, and Vercel/static-host deployment instructions.

Security

Review SECURITY.md before using SabHaven for sensitive or untrusted workloads. SabHaven is not end-to-end encrypted or independently audited and does not currently include malware scanning or per-user quotas.

Maintenance

See CHANGELOG.md for release history and ROADMAP.md for current maintenance priorities.