v0.3.0.21 — Security, GDPR, and accessibility

[0.3.0.21] — 2026-07-10

Security

• Open redirect — Request::safeRedirectFromReferer() requires exact host match with site.url; safeRedirectPath() tightens path allowlist. LocaleController and rate-limit redirect in ReportController use the helper. Regression tests in SecurityRegressionTest.

Fixed

• Accessibility (light theme) — badge and footer link contrast via --badge-fg / --footer-link-fg; .board-panel-view-all uses --accent-hover for WCAG 4.5:1 on white surfaces (default + modern themes).
• GDPR / Gravatar — third-party avatars load only after latch_cookie_consent=accepted in EU hosting mode; identicon placeholders with deferred data-gravatar-src until accept. CookieConsentGate + updated cookie policy copy (all locales).

Changed

• PHPUnit configs — split smoke/security into phpunit-smoke.xml.dist and phpunit-security.xml.dist; bin/latch test picks config by suite (eliminates duplicate-suite warnings).
• Public docs & templates — replace operator-specific latch.network examples with forum.example.com; footer uses site.url and GitHub for “Powered by Latch”; release build rejects latch.network / images.latch.network in staged source/.