v0.23.8
June 18, 2026
Security hardening (extension token scope, CORS, HSTS) and extension robustness fixes
-
Security
Extension token confined to its endpoints
The token generated by the Chrome extension can now access **only** the extension endpoints. Before, if exfiltrated, it could read flows/items and even create or revoke web API keys — it is now **rejected** on all general endpoints.
-
Security
Robust CORS and HSTS
Requests from a non-allowed origin are now rejected cleanly instead of producing 500 server errors. Added the **HSTS** header to force browsers to always use HTTPS.
-
Improvement
Stricter type validation + clearer API key revoke
On critical fields (item title, transition target status) a wrong-typed value (e.g. a number instead of text) is now **rejected** instead of silently converted. Deleting an API key is a **revoke** and the response now says so explicitly.
-
Improvement
Extension robustness
No more duplicate proactive toasts or double-submit on a transition; automatic local-storage cleanup; API calls centralized in the service worker; consistent escaping and removal of unused code.