v0.3.4 — your numbers were wrong; here is the correction

This release changes the cost figures Burnmeter shows you. They were wrong, in both directions.

An audit of the pricing path found three independent errors that had been partly cancelling each other out, which is why nothing looked obviously broken. On the maker's own 30-day history the dashboard reported $13,097 where the true cost was $12,218.

Fixed — cost accuracy

• Sonnet 5 was billed at Sonnet 4.x rates (+50%). Prices were looked up by family name, so a newer model inherited its predecessor's rate.
• Fable 5.1 cache reads were billed at 4x the real rate ($1.00 vs $0.25 per million). Cache reads dominate agentic sessions.
• 1-hour cache writes were billed at the 5-minute rate. Claude Code writes most of its cache with the 1h TTL, which costs 2.0x input instead of 1.25x — this one made the app report less than reality (69% of writes in a heavy month).
• Missing OpenAI tiers: gpt-6-astra was charged half its real rate, and the three GPT-5.6 tiers collapsed into one row — gpt-5.6-luna was reported at roughly 25x its actual price. gpt-5.5-pro and gpt-5.4-nano were also wrong.

Price rows are now per model version, verified against the providers' live pricing pages. A model whose version isn't in the table is still costed, but the app now says so — the models card names it, shows the spend involved, and dates the last price check. Nothing is silently guessed any more.

Fixed — security

POST /api/update accepted a custom header as proof the request came from your own dashboard. That holds for ordinary cross-origin requests, but not against DNS rebinding: a page you have open can point its own domain at 127.0.0.1, at which point the browser treats it as same-origin and its JavaScript can set any header — enough to trigger an install and relaunch. The same gap left your usage data readable the same way: project paths, branch names, chat titles, per-session cost, and for Pro users the decrypted cross-device snapshot.

Every /api/* request now validates the Host header. Serving on a LAN deliberately still works, and BURNMETER_ALLOWED_HOSTS covers a reverse proxy.

Fixed — first run and layout

• A brand-new install no longer grades usage that doesn't exist. It used to show a red "Cache hit 0.0% — low" verdict beside "No usage data yet"; it now reads "Waiting for your first session".
• A long project folder name no longer pushes the cost column out of view.

Note on upgrading

The first launch after this update re-reads your history once (about 40 seconds on a large one) because cost records now carry the cache TTL split. Subsequent launches are normal.

🤖 Generated with Claude Code