v1.2.0

Two months of security hardening, notification channels, and MCP polish since v1.1.0 — ~110 commits.

Highlights

• Breach-alert notification channels — get breach alerts pushed to Slack, Microsoft Teams, or any webhook, configured account-wide from the dashboard.
• MCP server matured — server card served on the API host, MCP registry/directory listing files, protocol version negotiation, validated tool inputs with actionable errors, tool titles and read-only annotations, and per-tool rate-limit counters with raised envelope limits.

Security

• Bound DNS and HTML domain-ownership proofs to server-issued single-use challenges
• Separated the single-use dashboard login challenge from the random session bearer
• Dashboard magic-link tokens are now revoked on sign-out
• Hardened webhook delivery against SSRF: pinned to the validated public IP, replies streamed unread, each attempt capped in size
• Security email links are now built from the configured BASE_URL (host-header injection fix)
• Unsubscribe state flips only after emailed confirmation
• Email deliverability checks added to shield-on and domain email verification
• Removed the MCP origin allowlist that blocked browser-based clients; stripped upsell copy from MCP rate-limit errors

Features

• Slack, Teams, and generic webhook breach-alert channels, refactored to be account-wide
• MCP registry and directory listing files; server card on the API host
• Per-MCP-tool rate-limit counters
• GA and Hotjar analytics across all templates

Fixes

• Unrecognised exposed-data types are now mapped correctly in breach analytics
• Whitespace stripped when parsing breach sensitivity flags
• MCP spec compliance: list_breaches repaired with capped response size, get_recent_breaches sorted and limited, notifications and ping handled per spec, GET /mcp returns 405, clean JSON in tool results
• Cloudflare blocks recorded for automatic release
• Offline test suite restored, with email deliverability coverage

Performance

• MCP ping exempted from the envelope rate limit

Docs

• README tidy-up: security scan badges, X badges, built-in /docs playground links, merged duplicate security sections

Dependencies

• FastAPI ≥0.150.0, Starlette ≥1.9.0, pydantic ≥2.14.1, uvicorn ≥0.54.0, cryptography ≥50.0.2, plus routine CI action bumps (CodeQL, Scorecard, Black, Docker actions)