v0.1.1

Security

• Base images, GitHub Actions and the two scanners CI installs are pinned by digest or exact version
  rather than by a mutable tag.
• containerd/v2 to 2.3.5 (GHSA-7jxh-36q5-gcqv) and moby/go-archive to 0.3.0 (GO-2026-6253, a
  crafted tar writing outside the extraction directory).
• The console's vite to 8.3.0, with @vitejs/plugin-react 6.1.1 alongside it, clearing six
  high-severity dev-server advisories.
• A malformed stored credential hash no longer crashes the sign-in path or verifies against an
  arbitrary password. argon2.IDKey panics rather than returning an error on a zero time cost or
  zero parallelism, and an empty key field compared equal to an empty candidate, so a corrupted or
  hand-edited row could take the process down or accept anything. Both are now rejected during
  decoding. Found by fuzzing; covered by TestR042_AMalformedStoredHashDeniesRatherThanPanics.
• Session cookies are marked Secure behind a TLS-terminating reverse proxy. Pando sees plain HTTP
  in that topology, so it could not tell an encrypted browser connection from an unencrypted one and
  sent the cookie without the attribute; one plaintext request to the hostname put a live session on
  the wire. Set PANDO_SERVER_EXTERNAL_URL to the address browsers use. Upgrade note: an
  installation behind a proxy should set it — unset keeps the previous behavior, which is correct
  only when Pando serves TLS itself or runs on localhost. (O-19)
• The API server sets ReadHeaderTimeout and IdleTimeout. Without them a client dribbling header
  bytes held a connection open indefinitely. The proxy's per-app listeners already did this; the API
  server was the one that did not. Found by gosec.

Added

• Security policy, coordinated disclosure process and documented security model
  (SECURITY.md).
• Checksums signed with cosign on every release, and the verification procedure that goes with them
  (docs/releasing.md).
• CodeQL, gosec, govulncheck, gitleaks and OpenSSF Scorecard in continuous integration.
• Fuzz targets over the parsers that see untrusted input, run in continuous integration.
• Issue and pull request templates, a code of conduct, Dependabot, and a reference index of the
  external interfaces (docs/reference.md).

Fixed

• The Docker image ships with the console in it. docker compose up -d built an image whose binary
  had no UI embedded, so it served the API and returned 404 for every console route.