v1.4.0
Security Hardening & API Rate Limiting
- SecurityAdded timing-safe HMAC comparison for webhook signature verification
- SecurityHardened XSS sanitization — entity decode before tag stripping prevents bypass
- SecurityFixed cron endpoint auth bypass when CRON_SECRET is unset
- SecurityHealth endpoint now requires auth for full diagnostics; public response is minimal
- FeatureAPI rate limiting with sliding window (100 req/min per key) via Upstash Redis
- FeatureRate limit headers (X-RateLimit-Limit, X-RateLimit-Remaining, X-RateLimit-Reset) on all /api/v1/* responses
- ImprovementCSV exports now escape formula injection characters (=, +, -, @, tab, CR)
- ImprovementAI chat errors return classified user-safe messages instead of raw internals