Kept 1.9.1

Features

• Added Open note to reminder banners. Clicking a browser notification now opens its note too, including when Kept is already open. Thanks to @tendimensions for suggesting this in #109!
• Added optional email invitations for admins, with SMTP configured on the server.

Fixes

• New notes no longer appear twice while you’re writing them in the web editor. Autosave still runs, and the note appears in the overview when you close the editor.
• Improved reminder banner layout on smaller screens.

Security

• Fixed locked-note content and passcode hashes being exposed to MCP/OAuth integrations without unlock approval. Protected related image, attachment, reminder and sharing paths.
• Added protection against internal-network requests through CalDAV and browser push subscriptions.
• Limited incorrect passcode attempts through external-access unlock pages, with a clear message showing when to try again.

Thank you to @t-animal for finding and reporting these security issues.

Updating

Private CalDAV servers and custom internal push services now require an explicit administrator-configured exception. Normal HTTP/LAN access to Kept is unchanged.

Mobile UI improvements require the updated iOS or Android app.