v0.4.0 — Security Hardening

[TruthSeeker04]

This release is a full remediation pass from a top-to-bottom security audit of the app and its deployment stack — plus the new job-linking workflow connecting Contacts, Assets, and Finance.

🔒 Security hardening

Account protection

• Login lockout — 10 failed attempts against an account within 15 minutes temporarily refuses further logins (429). Stops distributed credential-stuffing that per-IP limits miss; can't be abused to lock a victim out permanently.
• The programmatic token endpoint is now rate-limited like the browser login, and both share one attempt budget.
• Constant-time login — unknown emails take as long to reject as known ones, closing an account-enumeration side channel.

Browser & API protections

• Content-Security-Policy shipped and verified live (script-src 'self'), plus Strict-Transport-Security and a restrictive Permissions-Policy.
• Automation Inbox links are scheme-checked — javascript:/data: URLs are rejected at the boundary and defused in the UI.
• The automation API's asset read endpoint now serves only the shared team/household pools — a leaked token can no longer dump an individual user's asset store.

Self-hosting & deployment

• The app container no longer mounts the Docker socket. Container operations go through a locked-down socket proxy that permits only what the updater and tunnel need.
• n8n and ntfy ports are loopback-only; fresh installs generate strong random n8n keys instead of shipped defaults.
• The app refuses to start on a default/empty SECRET_KEY (set ALLOW_INSECURE_SECRET_KEY=true for local dev).
• Secure-by-default installer: COOKIE_SECURE=true, no wildcard CORS on fresh installs.
• Third-party images pinned to exact versions; opt-in GPG-signed update verification; opt-in encrypted backups; Infisical secret sync to n8n now allow-listed instead of whole-vault.
• Dependency updates: python-jose 3.4.0, python-multipart 0.0.18, Vite 5.4.x.

A new Help → Security & Privacy section explains all of this in plain language and technical detail.

🔗 Deals, assets, invoices, and money — linked

• Attach assets to a deal and see a Job P&L: invoiced, collected, expenses from linked assets, net job profit.
• Create a pre-filled invoice from a Won deal; a deal can bill multiple invoices (deposits, progress, final).
• Tag transactions with an asset — every asset page shows its Finance activity (income / expenses / net).
• Contacts get a References card: every asset, invoice, and dollar tied to that person or company.
• Everything clicks through to everything: invoice → deal → assets → transactions and back.

🩹 Fixes

• The post-update What's-New announcement now fires reliably after in-place updates.
• Release tags with a capital V no longer break version comparison.
• The Updates card's ↺ button does a real cache-busting check.

⚠️ Upgrade notes for self-hosters

• Re-run launch.sh after pulling so the new socket-proxy service starts and the app container picks up its new Docker configuration.
• n8n is now pinned to 2.31.3 (previously :latest). If your workflows misbehave, pin back — and never rotate N8N_ENCRYPTION_KEY on an install with existing n8n data.
• n8n/ntfy are no longer reachable on your public interface — use the tunnel or an SSH port-forward.
• Existing .env files are untouched; only fresh installs get the new secure defaults.

Full details in CHANGELOG.md.

---

This discussion was created from the release v0.4.0 — Security Hardening.