v1.2.2 - Safe Conditional Trade Confirmation

Highlights

• Added per-account trade confirmation modes: manual review, confirm all, and incoming items only.
• Incoming-items mode fails closed: a trade is confirmed only when Steam explicitly reports no outgoing assets and at least one incoming asset.
• Trade and login auto-confirm controls remain independent.

Security and Reliability

• Added CSP and webhook SSRF hardening.
• Updated runtime dependencies; production dependency audits are clean.
• Removed an unused PWA asset generator that could make CI flaky through Sharp/libvips downloads.
• Replaced secret-like test fixtures so secret scanning remains enabled and actionable.

Verification

• Backend: build, lint, and 94 tests passed.
• Frontend: build, lint, and unit tests passed.
• GitHub Actions CI is green across backend, frontend, audits, and secret scanning.

v1.2.1 - Runtime Dependency Security Update

SteamGuard Web v1.2.1

Security patch release for runtime dependency vulnerabilities, including the critical protobufjs RCE advisory.

Security

• Updated protobufjs to patched 7.5.5.
• Overrode steam-appticket to 2.0.1 to remove the vulnerable transitive protobufjs@6.x path.
• Updated fastify to 5.8.5.
• Updated axios to 1.15.2.
• Updated follow-redirects to 1.16.0.
• Updated yaml to 2.8.3.

Validation

• Backend runtime audit passes:
  • npm audit --omit=dev --audit-level=high
• Frontend runtime audit passes:
  • npm audit --omit=dev --audit-level=high
• Backend build, lint, and tests pass.
• Frontend production build passes.

Upgrade

git pull
docker compose up -d --build

Notes

• No database migrations.
• No environment variable changes.

v1.2.0 — Recovery Flows, TOTP, and Admin Controls

This release expands account security, admin controls, and notification capabilities across the project.

Highlights

• Added admin audit trail with categorized security, auth, and Steam events
• Added webhook notifications with generic and Discord webhook targets
• Added registration policies including open, disabled, domain allowlist, and invite-only modes
• Added invite code management in the admin panel
• Added authenticator app (TOTP) setup and login verification
• Added break-glass recovery codes for account recovery and 2FA reset
• Added usernameless passkey login while keeping email-first passkey fallback
• Added recovery-aware login UI and improved Telegram login UX
• Removed the unused Steam user ID field from settings and schema
• Improved bot-to-backend proxy handling for Telegram login in production

Notes

• Existing databases are upgraded automatically on backend startup
• Recovery code regeneration requires sensitive password re-authentication
• Using a recovery code resets configured 2FA and removes registered passkeys for that user
• Usernameless passkey login depends on discoverable passkeys supported by the device/browser
• Production backend and frontend were rebuilt and verified after these changes

Verification

• Backend lint passed
• Backend test suite passed
• Frontend lint passed
• Frontend tests passed
• Frontend production build passed

Full Changelog: v1.1.0...v1.2.0

v1.1.0 — Account Folders, Tags, and Queue Cleanup

This release adds the first account-organization features and improves confirmation/session UX.

Highlights

• Added account folders and tags for organizing Steam accounts
• Added account organization controls on the accounts list and account details pages
• Added filtering by folder and tag in the accounts view
• Added backend API and schema support for folders, tags, and tag assignments
• Cleaned up confirmation queue behavior so only active pending items are shown
• Improved Steam session-expired notifications with accurate messaging about automatic recovery
• Localized session-expired notifications to match the user's selected site language
• Automatically clears stale steam_session_expired notifications after successful session recovery or manual session refresh

Notes

• This is the first feature release after the v1.0.9 security hardening work
• Existing databases are upgraded automatically on backend startup
• Production stack was rebuilt and verified after these changes

Verification

• Backend tests and lint passed
• Frontend lint, tests, and production build passed

Full Changelog: v1.0.9...v1.1.0

v1.0.9 — Security Hardening and Shared Rate Limiting

This release focuses on security hardening, safer production defaults, and more resilient request throttling.

Highlights

• Added stronger production startup checks for insecure default or weak secrets
• Introduced optional FORCE_HTTPS and safer production behavior around transport security
• Disabled OpenAPI exposure by default in production unless explicitly enabled
• Removed legacy Telegram OAuth polling token support via query string
• Added Cache-Control: no-store for API responses handling sensitive data
• Strengthened sensitive-action protection for destructive account and admin operations
• Added Redis-backed shared rate limiting with in-memory fallback for local and degraded scenarios
• Hardened Telegram bot token handling
• Expanded CI with secret scanning and dependency audit jobs
• Added regression tests for security-sensitive flows

Operational Notes

• Replace placeholder values for JWT_SECRET, COOKIE_SECRET, and ENCRYPTION_KEY before production deploy
• If needed, generate secrets with openssl rand -hex 32
• OPENAPI_ENABLED should remain disabled in production unless explicitly required
• Docker Compose now defaults to Redis-backed rate limiting via the internal Redis service

Versioning

This is a patch release under the current versioning policy because it improves security and deployment safety without introducing intended breaking changes.

Full Changelog: v1.0.8...v1.0.9

v1.0.8 - Anti-Bot Registration and Sensitive Action Hardening

SteamGuard Web v1.0.8

This release strengthens registration protection, improves handling of sensitive account actions, and tightens several security-critical flows.

Highlights

• Added anti-bot protection for registration with:
  • backend registration challenge validation
  • honeypot field
  • stricter registration rate limits
  • optional Cloudflare Turnstile support
• Switched registration to invisible Turnstile flow for a cleaner UX.
• Added password re-confirmation for sensitive Steam account actions:
  • .maFile export
  • recovery code reveal
  • manual Steam session save
• Blocked production startup when using the default admin password.
• Removed WebSocket authentication via query-string token.

Admin

• Added user deletion from the admin panel.
• User deletion now safely handles linked account log references before removal.

Security Impact

• Reduces automated fake registrations.
• Makes it significantly harder to extract Steam secrets from a stolen normal web session alone.
• Reduces session token exposure risk in WebSocket usage.
• Prevents unsafe production bootstrap with default admin credentials.

Scope

• Backend and frontend update
• No database migration required
• Existing deployments should rebuild containers after updating

Full Changelog: v1.0.7...v1.0.8

Deployment

docker compose up -d --build backend frontend

v1.0.7 - Fix Steam Session Recovery for Web Refresh Tokens

SteamGuard Web v1.0.7

This patch fixes Steam session recovery for accounts that store a web/client refresh token instead of a mobile refresh token.

Fixed

• Steam session recovery now detects refresh token audience automatically.
• Accounts using web/client refresh tokens no longer fail during automatic confirmation polling.
• Backend recovery flow now selects the correct Steam platform type based on the stored token.

Impact

• Fixes repeated polling failures for some accounts after reconnect.
• Restores stable automatic confirmation sync for affected accounts.
• Live codes continue to work as before.

Notes

• This is a backend-only patch.
• No database migrations.
• No environment variable changes.

Full Changelog: v1.0.6...v1.0.7

v1.0.6 - Telegram Localization by User Language

SteamGuard Web v1.0.6

This release adds Telegram localization based on the user's selected language in SteamGuard Web.

Highlights

• Telegram notifications now follow the user's web language setting.
• Default language remains English (en).
• Switching the language in web settings affects all new Telegram messages immediately.

What is localized

• Steam login confirmation alerts
• Trade confirmation alerts
• Steam Guard code notifications
• Telegram 2FA login codes
• Inline button labels for login and trade actions
• Telegram bot replies for:
  • /start
  • /status
  • /accounts
  • /codes
  • /confirm
  • /add
  • inline confirmation results

Behavior

• Existing Telegram messages are unchanged.
• New notifications and bot replies use the currently saved user language.
• If the language cannot be resolved, English is used as the fallback.

Scope

• Backend and Telegram bot update
• No database migrations
• No environment variable changes

v1.0.5 - Correct Trade Telegram Actions and Confirmation Labels

SteamGuard Web v1.0.5

This patch fixes Telegram handling for Steam trade confirmations.

Fixed

• Corrected confirmation type mapping for legacy Steam mobile confirmations.
• Trade and market confirmations are no longer mislabeled as login confirmations.
• Telegram trade notifications now include inline action buttons.
• Trade action labels in Telegram are now shown as:
  • Approve
  • Decline

Result

• Trade confirmations no longer send misleading Steam login messages.
• Steam Guard codes are no longer attached to trade notifications by mistake.
• Manual confirmation from Telegram now works for trade alerts without requiring auto-confirm.

Scope

• Backend-only patch.
• No database migrations.
• No environment variable changes.

Full Changelog: v1.0.4...v1.0.5

v1.0.4 - Steam Session Recovery and Faster Login Alerts

SteamGuard Web v1.0.4

This release restores Steam login alert reliability for accounts with expired web sessions and improves confirmation detection speed.

Highlights

• Added automatic Steam session recovery using stored refresh tokens.
• Added a reconnect flow for older accounts that lost Steam web session state.
• Reconnect now uses the account's own Steam Guard mobile code automatically when possible.
• Persisted refreshed Steam session data back into encrypted account storage.
• Extended session recovery to Telegram inline confirmation actions.
• Reduced backend Steam polling interval to 5 seconds by default.

User Impact

• Steam login alerts in Telegram should resume for accounts with recoverable session state.
• Older accounts can now be repaired from the account details page without re-adding the account.
• New confirmation events are detected faster.

Technical Notes

• Updated backend session recovery flow for Steam confirmations.
• Added reconnect API and account detail UI for session refresh.
• Default STEAM_POLL_INTERVAL_SEC in .env.example is now 5.

Deployment

• Pull latest changes.
• Rebuild and restart containers:
  • docker compose up -d --build

Notes

• Existing accounts created before refresh-token persistence may need one manual reconnect once.
• .env secrets are unchanged and were not included in the repository.

Full Changelog: v1.0.3...v1.0.4