Repository navigation
SabHaven v1.2.0 adds the hosted-service legal, privacy, account-control, and error-state framework.
Added
- Privacy Policy, Terms of Service, Acceptable Use, abuse-reporting, security, and contact pages.
- Versioned Terms acceptance during invite-only registration with server-timestamped acceptance records.
- Signed-in account-data export and automated account deletion for eligible non-owner accounts.
- Custom 403, 404, 410, and application-error screens.
- RFC 9116-style security.txt contact metadata.
- Repository copies of Privacy, Terms, and Acceptable Use policies.
Security and privacy
- Account deletion removes owned Storage objects before deleting the Auth account.
- Automated deletion cannot remove the single owner account.
- Account tools require authenticated user JWTs and independently resolve the caller.
- Members can read only their own invite-redemption history.
- Hosted responses include CSP, HSTS, frame denial, MIME-sniffing protection, referrer policy, and restrictive browser permissions.
- Registration distinguishes contractual Terms acceptance from acknowledgement of the Privacy Policy.
Self-hosting
Self-hosters should deploy the new migrations and account-tools Edge Function and replace the hosted-service legal documents with policies appropriate to their own deployment.
See CHANGELOG.md for the full change summary.