v1.1.0

What's Changed

This release hardens the platform for production use. All previously identified
correctness bugs are fixed, and the server now enforces security and reliability
constraints out of the box.

Security

• API key authentication — set API_KEY env var; clients send X-API-Key header or Authorization: Bearer
• Per-IP rate limiting — sliding-window, configurable via RATE_LIMIT_PER_MIN (default: 100/min)
• Read-only database API — /db endpoint now accepts only SELECT and WITH queries
• Request body limit — 1 MB cap on all write endpoints
• Function name validation — only a-z A-Z 0-9 _ - allowed, path traversal is not possible
• Non-root container — Dockerfile now runs as an unprivileged user

Reliability

• Function timeout — every execution runs in a goroutine with a deadline (FUNCTION_TIMEOUT_SECS, default: 30s)
• Panic recovery — a panicking function returns an error response instead of crashing the server
• CORS support — all endpoints respond to preflight OPTIONS requests

Bug Fixes

• WASM I/O was broken — switched to WASI stdio: input arrives as JSON on stdin, output is read as JSON from stdout
• WASM recompiled on every call — compiled modules are now cached by file path and modification time
• Unsubscribe never worked — Subscribe now returns a cancel function backed by a unique handler ID
• Redis client typed as any — now properly typed as *redis.Client; Close() also closes Redis
• DB response lost type information — native types are preserved; only []byte columns are cast to string

Infrastructure

• go.sum is now copied in Dockerfile for correct dependency layer caching
• Binary is built with -trimpath -ldflags="-s -w" for a smaller, non-leaking artifact
• gRPC port 9090 is exposed in both Dockerfile and docker-compose
• docker-compose services now have health checks and depends_on: condition: service_healthy

Configuration

Variable	Default	Description
API_KEY	(empty)	Required in production
FUNCTION_TIMEOUT_SECS	30	Per-execution deadline
RATE_LIMIT_PER_MIN	100	Requests per IP per minute

v1.0.1

added examples

v1.0.0

self hosted serverless