Release Muster v1.0.0 · SolidGeeks/muster

[1.0.0] - 2026-10-25

First release.

Playbooks drawn as diagrams: actions, decisions, owners and SLAs, with keyboard shortcuts (A action, D decision) and drafts saved automatically. Ten ready-made playbooks following the NIST phases: ransomware, phishing, compromised account, CEO fraud, personal data breach (GDPR 72 h), endpoint malware, DDoS, lost device, insider threat, exploited vulnerability.
Versioning: one shared draft per playbook with conflict detection, immutable published versions, and a diagram diff between any two versions.
Incidents and exercises run step by step on a frozen copy of the playbook: tasks, decisions, live SLAs, and an accelerated clock for tabletop exercises.
Incident reports written from the run, previewed on screen and downloaded as PDF; templates with logo, colour, ID pattern (IR-{YYYY}-{SEQ}…) and sections.
Accounts and roles (admin, editor, analyst, viewer), audit log, live updates for everyone through server-sent events.
Online version: a single page running the same interface in a Claude artifact (npm run build:online).
Docker image, signed: every release carries a Sigstore build provenance attestation. Check one with gh attestation verify oci://ghcr.io/solidgeeks/muster:1.0.0 --owner SolidGeeks.

scrypt password hashing, HttpOnly SameSite session cookies, a required X-Muster header on every write (CSRF protection), login rate limiting, strict Content-Security-Policy, role checks on every endpoint.

Licensed AGPL-3.0-or-later, with SPDX headers in every source file; SECURITY.md.
CI runs the type check and the API tests on every push and pull request; the Release workflow runs them again and publishes nothing if they fail.
The Docker build installs exactly the dependencies pinned in package-lock.json (npm ci).