v0.2.0 — Security & Architecture

Spottt v0.2.0

Security hardening, architecture cleanup, and dead code removal.

Security

• Token/config files written with 600/700 permissions (no longer world-readable)
• OAuth state parameter validated on callback (CSRF protection)
• CORS restricted from * to null (blocks cross-origin attacks)
• /action/ endpoint validates against whitelist
• API retry capped at 2 attempts (prevents stack overflow on persistent 401/429)

Architecture

• Merged duplicate _api_put/_api_post → single _api_request(method, path)
• Merged _exchange_code/_refresh → shared _token_request()
• _frame_cache bounded to 10 entries (prevents memory growth)
• Content-based ANSI cache key (replaces fragile id(frame))
• ThreadingHTTPServer replaces single-threaded HTTPServer
• Track metadata updates immediately on track change (no UI freeze during art download)

Cleanup

• Removed ~70 lines of dead code (unused properties, compat wrappers, broken keybindings)

Install

1. Download Spottt.dmg below
2. Drag Spottt.app to Applications
3. Run — enter your Spotify Client ID when prompted