Registrar v1.2.2

Registrar v1.2.2

Released 2026-10-22.

Fixes from a review of v1.2.1, mostly about data you import and the
sample data. Finding numbers (F1 to F13) are the reviewer's.

What's fixed

• Removing the sample keeps your changes (F1). If you loaded the sample
  data and then changed one of the credentials it set up (a start date, a
  carry-over), "Remove sample data" used to undo it anyway. Now it undoes
  only the settings that are still exactly as the sample left them, and
  tells you how many of yours it kept. Importing a backup made while the
  sample was loaded no longer brings the sample's bookkeeping with it, so
  removing sample activities afterwards never touches your settings.
• Imports are checked more strictly (F3, F4, F5). A backup file whose
  fields have the wrong type is refused with a message naming the field,
  evidence file names are cleaned the same way as uploads, and an embedded
  file over 15 MB is refused. Packet zips never contain a file name with a
  folder path in it.
• Big or slow files (F5). A file over 15 MB is refused straight away,
  before the app reads it. Reading a scanned certificate stops after 60
  seconds with "OCR timed out" instead of running on.
• Your own API key (F2, F8, F10). Requests to Anthropic use the API
  version every account accepts. The key field asks your browser and
  password manager not to offer to save it. The privacy page now says
  that a model on your own machine is reached over plain HTTP.
• Self-hosting guide (F6, F7). The demo-data steps no longer start by
  deleting your data: the demo runs in its own container. The settings
  table lists REGISTRAR_ALLOWED_HOSTS, which you need if you browse to a
  VPN address or a name.
• The website (F9). Unknown addresses get a proper "Page not found"
  page, and every page, that one included, runs no scripts.

Also in this release

• The footers of the landing page and the privacy page say "Built with
  AI-assisted development." (F13).
• ceu.tools is also served at cpe.insiderthreatanalyst.com and mirrored on
  GitHub Pages. Your data lives in your browser under whichever address
  you use: export before switching, then import at the new address.

Worth knowing

• Rules change. Confirm anything you rely on with your body's own portal.

Registrar v1.2.1

• "How each body counts" on ceu.tools fits your screen. On a phone or a
  narrow window each body is a card: name, unit and credentials, then the
  cycle, cycle total, annual minimum, categories and caps, how you submit,
  and a link to the body's own policy page. On a wide screen the same
  entries line up as a comparison grid, up to 1200 px. Nothing scrolls
  sideways at any width.
• A body filter: tick the bodies you hold and the section shows just
  those, with a count such as "3 of 10 bodies shown". All shows every body
  again. It works from the keyboard.
• One source for the rules: the section is generated from bodies.yaml,
  the same data the browser app uses. The figures and the UNVERIFIED
  badges are unchanged.
• The landing page still runs no scripts and sets no cookies, so the
  filter does not remember your choice after a reload.

Registrar v1.2.0

• A CPE/CEU guide on ceu.tools: cycles, groups and caps, audit-ready
  records, what usually does not count, the first 90 days with a new
  certification, where to earn credits, how each body counts, and a
  glossary. Adapted from insiderthreatanalyst.com/cpe (CC BY 4.0).
• First run in the browser app asks which credentials you hold; progress,
  the activity form, Settings, Rules, the calendar and the reports follow
  from the answer.
• Sample data: three credentials from three bodies (CISSP, CySA+ and CFE)
  and nine invented activities with certificates, removed in one click.
• Reports made in your browser: activities as CSV, an Excel workbook with
  Activities, Evidence and Totals sheets, and a calendar (.ics) of cycle
  ends with alerts 90 and 30 days before.
• The footer shows the version and build, linked to the release notes.
• New privacy page, security.txt, link previews and app icons.
• An axe audit of the site and the app, in light and dark mode, reports
  no violations, and the core flow works with the keyboard alone.

Registrar v1.1.0

• Browser app at ceu.tools/app: local-first (the ledger stays in your
  browser and works offline), with evidence capture from PDFs and photos.
• Self-host with docker-compose (docs/SELF-HOST.md).
• The user interface is renamed to Registrar.
• Host-allowlist fixes: a name with a doubled trailing dot is refused,
  IPv6 entries with a port are documented (bracketed), and the compose
  file passes REGISTRAR_ALLOWED_HOSTS through.

Registrar v1.0.0

Registrar v1.0.0

The first public release of Registrar, a self-hosted tracker for the
continuing-education credits (CPEs, CEUs, PDUs) that professional
certifications require. It runs on the Python 3 standard library, keeps
your records in one SQLite file on your own machine, and has no account,
no cloud service and no telemetry.

What it does

• Totals the way each body counts them. Caps, category minimums,
  yearly registration windows and per-item activities are applied per
  credential, and every screen shows the counted total next to the naive
  sum of hours, with any forfeited credits stated.
• Seven credentials out of the box: CISSP (ISC2), CySA+ (CompTIA), CEH
  (EC-Council), GCITP (University of Maryland), ATAP membership, CTM (ATAP)
  and CFE (ACFE). The rules live in one data file, bodies.yaml, with a
  source link on every number.
• Capture, then confirm. Log an activity from the web form or,
  optionally, from your own Telegram bot. A capture counts only once you
  confirm it.
• Evidence with hashes. Attached files are hashed on arrival and
  re-checked on demand; a file that no longer matches is refused.
• Deadline calendar. One .ics file with cycle ends, grace periods,
  registration windows, mid-cycle minimums and fees. Re-importing updates
  events rather than duplicating them.
• Submission packets. Your body's form fields, in order, with the
  values filled in, plus a zip of your evidence with a manifest. You sign
  in to the body's portal and submit yourself: Registrar never asks for,
  stores or uses your portal login.
• Renewal report, quiet reminders (at most one a day, only when you
  are behind or something is overdue), CSV and JSON exports, and a what-if
  calculator that writes nothing.
• Nothing is deleted. Edits supersede the old version and mistakes are
  voided; both stay on record and voided entries never count.
• Command line: python3 -m cpebot ics, packet and packetmaps.

Security posture

• No login by design: bind to loopback (the default) or to one private
  interface you trust, never to a public one. There is no TLS.
• The web app answers only to an allowed Host header (localhost,
  127.0.0.1, [::1], the bind address, or names you list in
  CPEBOT_ALLOWED_HOSTS) and refuses anything else with
  400 Bad Host header, which blocks DNS-rebinding attacks from other web
  pages in your browser.
• Every form post carries an anti-forgery token, and every page is served
  with a strict Content-Security-Policy and no scripts.
• An unexpected error shows a plain error page; the details go to the
  server log only. Rule source links are rendered only for http(s) URLs.
• The Telegram bot ships without a token and refuses every chat until you
  set your own chat id; it warns about this when it starts.

Known limitations

• Unverified rule values. Some numbers in bodies.yaml could not be
  confirmed against the body's own pages. They are shown with an
  UNVERIFIED badge on every screen, and where a body's category caps
  are unknown (CTM) Registrar gives no compliance verdict at all. The
  README's units table lists each one. Your body's portal is always
  authoritative.
• ISC2 packet field labels are unverified. The values in an ISC2
  packet are right, but the field labels and their order were not read off
  the live form, which needs a member login. Corrections are welcome in
  packetmaps/isc2.yaml.
• No container setup yet. Run it from a checkout, or as a systemd user
  service from the templates in systemd/. A docker-compose setup is
  coming in a v1.0.x release.
• No authentication, TLS or rate limiting, so it must not be exposed to the
  internet (see above).

Upgrading

This is the first release; there is nothing to migrate. A ledger created
by an earlier development build opens as-is: schema changes are additive.

Reporting security issues

Please report vulnerabilities privately through GitHub's private
vulnerability reporting for this repository (the Security tab, then
Report a vulnerability). Do not open a public issue. SECURITY.md gives
an email fallback and describes what is in scope.

License

AGPL-3.0. See LICENSE, NOTICE and THIRDPARTY.md.