v0.1.1 — security hardening

Three defense-in-depth measures based on a post-launch security audit:

Fixes

1. Refuse --host 0.0.0.0 (or any non-loopback) without WEBHOOK_SECRET. Without this, npx formloop --host 0.0.0.0 would expose every endpoint to the LAN with no auth (create/list/export/read all open). Now exits 1 with a clear error message.

2. Validate form id on the 4 API routes that take it as a path param (/api/forms/[id]/submit, /api/forms/[id]/submissions, /api/forms/[id]/export.csv, /api/response/[id]). Pattern enforced: /^[A-Za-z0-9]{1,64}$/. Defense-in-depth against absurdly long ids hitting store keys.

3. Disable Next.js anonymous telemetry by default (NEXT_TELEMETRY_DISABLED=1) when running via the formloop bin. formloop is a local-first tool — no phone-home unless you opt back in with NEXT_TELEMETRY_DISABLED=0.

No data exposure

• No secrets in git history or published tarball (verified)
• No env vars baked into the standalone build (verified)
• Default bind to 127.0.0.1
• All admin endpoints already require WEBHOOK_SECRET when set
• HTML sanitization via sanitize-html with strict allowlist (<script>, <iframe>, JS event handlers, url() in CSS all blocked)
• Form IDs from crypto.getRandomValues, 62-char alphabet (62^10 entropy)
• JSON body size limit 512KB (DoS protection)