v0.3.1 — Security Hardening

Security Fixes

CRITICAL

• Remove hardcoded Damai APP_KEY default (requires env var now)

HIGH

• URL-encode Bark notification messages to prevent injection
• Move ServerChan key from URL path to POST body
• Sanitize HTML/script tags from event data before JSON export

MEDIUM

• Add shell metacharacter validation + shell=false to subprocess
• Add explicit verify=True to all httpx clients