What's Changed
[-] use random JWT secret instead of hardcoded key (#1475)
Important
The Web UI/API signed and validated all JWTs with a hardcoded key published in the source, letting anyone forge accepted tokens and bypass authentication.
Tokens now rotate on every restart, invalidating leaked ones.
Full Changelog: v5.2.0...v5.3.0