release 0.0.4
Covering security hardening for ASD STIG
compliance, a rebuilt calling experience, and a large chat overhaul.
Security and compliance:
- add security audit logging with size/age-based rotation, configurable
in settings.json, using a cross-platform lock and a Windows-safe rename - add session inactivity timeout (configurable, default two weeks,
0 disables), regenerate the session on authentication, and confirm
logoff explicitly - harden the password policy for APSC-DV-001940
- add COOP/COEP/CORP and Permissions-Policy headers and drop a server
timestamp leak - gate uploads on channel visibility and harden message rendering
- escape LIKE wildcards in DM channel matching
- add DoS mitigations with rate limiting and fair eviction
- add generic custom error handlers so internals never reach the client
- add an OWASP ZAP baseline DAST scan to CI
Calls:
- rebuild the call UI and let participants share screens as a group
- never strand a participant in a call nobody can end
- replace the call and message sounds with a synthesised set
Chat:
- load channel history a page at a time without snapping the scroll
position or interrupting mobile scrolling - add an unread divider, per-channel drafts, and a visible edit marker
- repair search jump, DM persistence, and assorted UI defects
- validate usernames live on the auth screens
Also includes SonarQube cleanups across the backend and frontend, tests
for the call surfaces and TLS 1.3 negotiation, a STIG compliance
reference page, and README corrections.
Full Changelog: v0.0.3...v0.0.4