3.6.3

Changed

• Outside local, Wave only accepts requests for the host in APP_URL and its subdomains, and other hosts get a 400. In production, set APP_URL to the domain the app is served on. Apps served on several domains can list them with $middleware->trustHosts(at: [...]) in bootstrap/app.php (#454)
• SECURITY.md points to GitHub's private vulnerability reporting (#454)

Removed

• role_id from the User model's $fillable. The users table has no such column (#454)

What's Changed

• Only answer to APP_URL's host outside local, update SECURITY.md by @bobbyiliev in #454
• chore: prepare 3.6.3 release by @bobbyiliev in #455

Full Changelog: 3.6.2...3.6.3