Skip to content

SafeHouse 0.3.0

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Oct 22:48
v0.3.0
2667419

  • Bot protection: rotating trap names and signed, one-use browser/form/post-bound challenges, fetched outside page caches, valid for 20 minutes with a one-second minimum age. Atomic consumption prevents replay; bounded database pools keep forms separate and reject temporarily if storage or capacity is unavailable.

  • Fixed ten-minute browser and reliable-IP budgets limit challenge issuance and submissions, with IPv6 grouped by /64. Automated browsers can still pass within the limits; distributed clients and cookie resets without a reliable IP remain limitations. Added accessible retry handling and Polish limit/unavailability messages.

  • Form UX: visible verification progress, connection-specific errors, accurate retry countdowns and recovery after resetting a form during verification. Fields and submit-button values stay intact; retry timing follows the actual quota window.

  • Hardening: independent XML-RPC pingback blocking even with Jetpack/WooPayments, plus opt-in reduction of REST/RSD/Writer/shortlink discovery metadata. REST endpoints and asset cache busting remain available.

  • Added adversarial honeypot, real-browser cache/retry and hardening integration regressions. Purge HTML and asset caches when upgrading the honeypot protocol.

  • Stability module: bounded local PHP incident observations, temporary HTTP timing samples, read-only WP-Cron/Action Scheduler diagnostics, Site Health and WP-CLI controls. No automatic third-party plugin deactivation or job cancellation.

  • Cooperative time/memory budgets and one worker per site for SafeHouse delivery. Five failed attempts pause retained jobs for explicit review and resumption. Alert and Cloudflare transport no longer runs inline in ordinary requests.

  • Targeted privilege-change checks and resumable full inventory reconciliation preserve immediate grant/revoke alerts without enumerating every account per user change.

  • Added failure, resource-budget, concurrency, privacy and lifecycle regressions plus Polish translations.

  • Release gates now exercise real ZIP installation, upgrade and removal on current and minimum supported WordPress/PHP, real WooCommerce Action Scheduler diagnostics and alert retry, and isolated PHP-FPM termination/recovery and CLI cron exclusion/deadline checks. Documented the separate hosting controls and target-site staging checks.

Signed release: manifest.json carries the SHA-256 of the zip and is signed with the SafeHouse release key (manifest.json.sig, Ed25519; public key in PUBLIC_KEYS, plugin/src/Core/Updater.php). Sites update from https://updates.designhouse.me/shouse/ and install only packages that pass both checks.

Assets 6
Loading