v0.1.1 — security hardening

Three defense-in-depth measures based on a post-launch security audit:

Fixes

1. Refuse --host 0.0.0.0 (or any non-loopback) without WEBHOOK_SECRET. Without this, npx formloop --host 0.0.0.0 would expose every endpoint to the LAN with no auth (create/list/export/read all open). Now exits 1 with a clear error message.

2. Validate form id on the 4 API routes that take it as a path param (/api/forms/[id]/submit, /api/forms/[id]/submissions, /api/forms/[id]/export.csv, /api/response/[id]). Pattern enforced: /^[A-Za-z0-9]{1,64}$/. Defense-in-depth against absurdly long ids hitting store keys.

3. Disable Next.js anonymous telemetry by default (NEXT_TELEMETRY_DISABLED=1) when running via the formloop bin. formloop is a local-first tool — no phone-home unless you opt back in with NEXT_TELEMETRY_DISABLED=0.

No data exposure

• No secrets in git history or published tarball (verified)
• No env vars baked into the standalone build (verified)
• Default bind to 127.0.0.1
• All admin endpoints already require WEBHOOK_SECRET when set
• HTML sanitization via sanitize-html with strict allowlist (<script>, <iframe>, JS event handlers, url() in CSS all blocked)
• Form IDs from crypto.getRandomValues, 62-char alphabet (62^10 entropy)
• JSON body size limit 512KB (DoS protection)

v0.1.0 — first public release

First public release of formloop.

Install

npx formloop                               # boots local server on 127.0.0.1:3847
/plugin marketplace add borenstejn/formloop  # Claude Code plugin
curl -fsSL https://raw.githubusercontent.com/borenstejn/formloop/master/install.sh | bash -s codex  # any other agent

What's in this release

• npm package formloop (Next.js standalone bundled, in-memory storage, zero config)
• Claude Code plugin manifest (.claude-plugin/marketplace.json)
• Cursor + VS Code Copilot auto-discovery manifests
• install.sh for 13 agent platforms (codex, gemini, opencode, vibe, openclaw, antigravity, hermes, cline, kimi, trae, vscode, claude, pi)
• Python SDK at packages/sdk-python/ask_form.py
• MCP server mode (formloop --mcp)

Block types

html, text, textarea, mc, multi, yn, number, scale, scale-preview, html-pick, rank — 11 block types covering simple inputs to drag-and-drop and HTML-mockup grids.

Self-hosting

Defaults to in-memory storage. Set KV_REST_API_URL + KV_REST_API_TOKEN for Upstash Redis persistence. WEBHOOK_SECRET for API auth on shared deployments.