v0.1.4

Spend limits, version 2. Daily and monthly period budget the owner changes in the UI (a run cannot raise it), reserve-then-settle under a lock file so concurrent requests cannot both pass, pending calls keep their reservation and are reconciled through GET /v1/runs/{id}, stored results so a repeated request is not charged twice. Sidebar and Costs page show used, reserved and remaining. No migration: the budget is a new file, budget.json, in LOOOT_SCORE_DIR.

v0.1.3: admin sign-in (security)

Security release. Versions 0.1.2 and older had no admin authentication. Anyone who could reach a running instance could start paid runs with a spend cap of their own choosing, rewrite the ICP file, and read the stored enrichment. If you run 0.1.2 or older on a reachable host, upgrade to 0.1.3 and set LOOOT_SCORE_ADMIN_PASSWORD.

What changed

• Every page and API route is public on purpose or admin. Admin routes need a signed session cookie, and state-changing requests also need a CSRF token and a same-origin request.
• Without LOOOT_SCORE_ADMIN_PASSWORD (12+ characters) admin routes answer 503 and /login shows a setup page.
• The run cap comes from LOOOT_SCORE_CAP_USD on the server (default 5). A capUsd in the request is ignored. The run is refused when the quote is above the cap. A session can start 6 runs per 10 minutes.
• Writing the ICP (PUT /api/icp) needs the session and the CSRF token.

Upgrading: set LOOOT_SCORE_ADMIN_PASSWORD, and LOOOT_SCORE_CAP_USD if 5 dollars is not what you want. The cap box on the page is gone. See "Securing a deployment" in the README.

v0.1.2

Sidebar layout: left sidebar that collapses to an icon rail, drawer on phones, spend panel, docs and GitHub links.

v0.1.1

Dependency security bump. next and eslint-config-next 16.3.7 to 16.3.8, which fixes six Next.js advisories (GHSA-3w37-wq28-93x7, GHSA-4jqv-mc3x-m676, GHSA-39w2-rjm5-chcv, GHSA-f87g-xv8r-7p7x, GHSA-mcj8-r9mp-w47p, GHSA-cjq9-62q9-8jv4). No code changes. v0.1.0 is unchanged.

v0.1.0

First release. Lead fit scoring on looot: CSV in, grade A to D with reasons and the provider behind each fact, editable ICP, re-scoring at no cost, quote before run, spend cap, demo mode, CLI and web UI. No paid looot run has been made; response parsers are built from provider docs and fixtures. See the README section on what is not tested.