v1.0.8 - Anti-Bot Registration and Sensitive Action Hardening

SteamGuard Web v1.0.8

This release strengthens registration protection, improves handling of sensitive account actions, and tightens several security-critical flows.

Highlights

• Added anti-bot protection for registration with:
  • backend registration challenge validation
  • honeypot field
  • stricter registration rate limits
  • optional Cloudflare Turnstile support
• Switched registration to invisible Turnstile flow for a cleaner UX.
• Added password re-confirmation for sensitive Steam account actions:
  • .maFile export
  • recovery code reveal
  • manual Steam session save
• Blocked production startup when using the default admin password.
• Removed WebSocket authentication via query-string token.

Admin

• Added user deletion from the admin panel.
• User deletion now safely handles linked account log references before removal.

Security Impact

• Reduces automated fake registrations.
• Makes it significantly harder to extract Steam secrets from a stolen normal web session alone.
• Reduces session token exposure risk in WebSocket usage.
• Prevents unsafe production bootstrap with default admin credentials.

Scope

• Backend and frontend update
• No database migration required
• Existing deployments should rebuild containers after updating

Full Changelog: v1.0.7...v1.0.8

Deployment

docker compose up -d --build backend frontend