Skip to content

0.2.1 (2026-04-18)

Security improvements, platform hardening, and admin user management enhancements.

✨ Features

  • Security audit log with automatic 90-day retention (MongoDB TTL index).
  • Events tracked: successful/failed login, account lockout, MFA verification, password change, password reset, recovery code usage, admin MFA reset.
  • Session invalidation on password change: all JWT tokens issued before the change are automatically invalidated.
  • Admin user management panel: diagram count per user and subscription plan name.
  • User Excel export includes diagram and plan columns.

🔧 Internal

  • Security headers middleware: X-Content-Type-Options, X-Frame-Options, X-XSS-Protection, Referrer-Policy, Permissions-Policy, Cache-Control, HSTS (production).
  • Swagger/OpenAPI disabled in production (/docs, /redoc, /openapi.json return 404).
  • Stack traces hidden in production: 500 errors return only {"detail": "Internal server error"}.
  • Login rate limiting: maximum 10 attempts per IP per minute.
  • Account lockout: temporary 15-minute lockout after 5 consecutive failed attempts.

🐛 Fixes

  • Fixed bug where MFA banner kept showing after activating MFA (mfaEnabled state was not recovered on page reload).
  • Fixed "Try another method" flow in MFA verification: now shows method selection screen instead of auto-sending email.
  • Recovery codes no longer regenerated when activating a second MFA method if unused codes already exist.
  • TypeScript compilation errors fixed for Digital Ocean deployment.