Skip to content

Hashavatar API 1.0.2

Choose a tag to compare

View all tags
@eldryoth eldryoth released this 31 May 10:45
Immutable release. Only release title and notes can be modified.
v1.0.2
This tag was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.
85bd581
This commit was signed with the committer’s verified signature.
eldryoth
SSH Key Fingerprint: EoLRQ5k4J5pYz3UMFmkrV798gYFNkToGS2xEPvebqB4
Verified
Learn about vigilant mode.

hashavatar-api 1.0.2

Security hardening and renderer update release.

  • Updated the API and demo to hashavatar 1.0.2.
  • Added stricter no-cache behavior for API error responses.
  • Added X-RateLimit-* headers on rate-limit responses.
  • Hardened trusted-proxy client IP handling against reserved/private forwarded IPs.
  • Validated S3 object prefixes and enabled explicit SSE-S3 on stored avatars.
  • Improved cache-key construction to avoid delimiter ambiguity.
  • Expanded browser security headers and added cross-domain policy hardening.
  • Added safer hashed-identity guidance in the documentation.
Assets 3
Loading
0 Join discussion