v0.0.91
What's Changed
Security
Fixes GHSA-6x65-w7q7-wg93: webhook header auth secrets, MCP API keys, portal
session tokens, and Discord interaction tokens were stored or returned in
plaintext where a database read or a collaborator could recover and replay them.
Reported by @SashaMIT.
Breaking: MCP no longer accepts credentials in the query string. Move ?key=
and ?token= to the X-MCP-Key or Authorization header before upgrading. The
?session= parameter used by the SSE handshake still works.
Behavior: MCP keys are now hashed at rest and shown once, when you generate
or regenerate them. Existing keys keep working, but the tab can no longer display
them.
Upgrading: Run migrations as usual. They backfill existing keys and sessions
in place, so nothing already issued breaks. They are one-way, so back up first if
you might roll back.
Full Changelog: v0.0.90...v0.0.91
