Release v3.14.0

v3.14.0

Changelog

Performance: tokens redacted in stored referers/route params; CSV formula guard See UPGRADING.

Security (SEC-004 re-audit 2026-10-29, Low)

• No secrets in access records. The stored route path, referer and route parameters kept full query strings, so
  reset / OAuth / signed-URL tokens ended up in the database, the dashboard and the exports. Values of sensitive keys
  (token, code, state, signature, password, secret, key, hash, expires, jwt, otp, session, …)
  are stored as [redacted] (Service\SensitiveDataRedactor); fragments are dropped.
• CSV formula injection. Cells starting with =, +, -, @, TAB or CR are prefixed with ' in the routes and
  access-records CSV exports (the referer is attacker-controlled).
• Referer links. The access-records pages link the referer only when it is an http(s):// URL; anything else is
  printed as text.
• Bounded chart window. api/chart-data clamps days to 1–365.

Commits

• Release v3.14.0: Performance: tokens redacted in stored referers/route params; CSV formula guard (089b976)
• fix(security): redact tokens in stored URLs/params; CSV formula guard (a67bf23)
• docs: demo screenshots near the top; document e2e targets (REQ-DEMO-013) (05ca4a8)
• docs(readme): GitHub stars badge image uses the repository slug (e416ddb)