Changelog - Dev - 06.13.2026
All notable changes to this project will be documented in this file.
The format is based on Keep a Changelog.
[Unreleased] - 2026-06-13
Added
- Implement user blocking with bidirectional invisibility: Users can now block others with mutual invisibility, preventing blocked users from seeing or interacting with the blocker. Addresses safety concern H-BLOCK. (#597)
security - Add GitHub Codespaces devcontainer for onboarding: Developers can now spin up a fully configured development environment in Codespaces with committed public Firebase config, reducing setup friction and improving reproducibility. (#597)
security - Drop amber from lantern match pool with color rotation: Refined beacon color scheme by removing amber and implementing venue-based color rotation for improved visual distinction and user experience. (#597)
security
Changed
- Make activeLanternCount server-authoritative with locked rules: Venue active lantern counts are now computed server-side and immutable client-side, preventing manipulation of venue popularity metrics (M-ALCOUNT). (#597)
security - Authorize lit-presence by fren relationship instead of connection time: Friends' presence visibility now correctly gates on actual fren relationship status rather than a loose 4-hour connection window, tightening privacy controls (CR-6). (#597)
security - Lock waves and lanterns to server-side creation and updates: Waves can only be created and lanterns only updated/deleted via server APIs, preventing client-side manipulation of core beacon state (CR-2, CR-3). (#597)
security - Enforce fail-closed E2EE plaintext once both peers have keys: Chat messages automatically fail-closed to encrypted-only mode once both participants have established E2EE keys, eliminating plaintext fallback risks (H-E2EE-2). (#597)
security - Make PIN failed-attempt counter atomic: PIN brute-force protection now uses atomic counter increments, eliminating race conditions that could allow bypass of attempt limits (M-COUNTERS). (#597)
security - Block re-registration for banned users and fail-closed phone reclaim: Banned users cannot re-register with the same phone number, and phone number reclaim requests fail-closed if the account is banned (H-BAN, H-RECLAIM). (#597)
security - Tighten Content Security Policy on web and admin: Removed unsafe-inline and unsafe-eval from script-src CSP directive and added object-src, base-uri, form-action, and frame-ancestors restrictions to prevent injection and framing attacks (M-CSP, L-CSP-EXTRA). (#597)
security - Consolidate backfill scaffold and align HTML escaping: Unified HTML escaping utilities across shared code to prevent XSS vulnerabilities in backfill operations (CR-15). (#597)
security
Fixed
- Fix adminProfiles demote-delete and lock flat venue/offer storage: Corrected admin profile demotion logic and prevented unauthorized modifications to venue and offer documents via Firestore rules (L-GRAB). (#597)
security - Fix stale mirror, expiry race, name clobber, and self-pin issues: Resolved multiple lantern and wave state consistency bugs including stale data mirrors, expiry race conditions, and self-pinning vulnerabilities (CR-7/8/9/11). (#597)
security - Close four account-deletion data residue gaps: Ensured complete PII cleanup during account deletion across lanternPins, publicProfiles, beaconInvites, scheduledLanterns, and checkins collections (CR-4, CR-5, CR-10, M-ADMINDEL). (#597)
security - Bound rate-limiter memory and validate entity attribution: Added memory limits to analytics rate-limiter and enforced entity attribution validation to prevent DoS and data corruption (CR-14, M-ENTITYID). (#597)
security - Fix broken Pages deploys and SHA-pin GitHub Actions: Restored Cloudflare Pages deployment pipeline and pinned all GitHub Actions to specific commit SHAs to prevent supply-chain attacks (CR-1, CR-12, CI-PIN). (#597)
security - Fix issue-title mangling and harden dev tooling: Corrected GitHub issue title handling, scoped gitleaks to exclude false positives, and hardened VS Code and development environment security (CR-13, SM-4, M-VSCODE, L-VSCODE2). (#597)
security - Remove dead plaintext chats and messages rules: Cleaned up obsolete Firestore rules that previously allowed plaintext chat access, reducing attack surface (L-GRAB). (#597)
security - Fix deletion-cascade PII residue and sanitize lantern names: Eliminated PII leakage in deletion cascades and enforced lantern name sanitization and length constraints to prevent injection attacks. (#597)
security - Fix deploy-dev Actions injection and harden scanner: Patched GitHub Actions injection vulnerability in deploy-dev workflow and added 14 new Firestore rules tests to prevent regressions. (#597)
security - Remove phone-to-name oracle and extend PII redaction: Eliminated phone number to name lookup endpoint that leaked user identity and extended Pino logging redaction to always mask PII. (#597)
security - Fix structural frens dedupe and add ReDoS guards: Corrected friend list deduplication logic and added regex denial-of-service (ReDoS) guards to file system operations (L-GRAB). (#597)
security - Flag steps.outputs/inputs taint in CI shell sinks: Added Semgrep rules to detect untrusted GitHub Actions step outputs/inputs used in shell commands, preventing injection attacks (CR-12). (#597)
security - Deterministic devcontainer install to fix corrupted Codespace builds: Locked devcontainer dependency installation to deterministic versions, preventing non-reproducible and potentially compromised builds. (#597)
security
Security
- Comprehensive security review and remediation (10 phases, 4 audit rounds): Completed a comprehensive security audit covering backend APIs, Firebase Functions, Firestore/Storage rules, frontend applications, E2EE chat, CI/CD, and edge workers. Fixed ~40 findings across 10 phases with 4 independent audit loops and Copilot code review, addressing critical issues in authentication, authorization, data deletion, rate limiting, CSP, and supply-chain security. (#597)
security - Annotate 7 verified-legitimate findings with nosemgrep: Documented and suppressed 7 Semgrep findings that were verified as safe after security review, reducing false positives in future scans. (#597)
security - Apply least-privilege CI permissions and drop unneeded PATs: Restricted GitHub Actions workflow permissions to minimum required and removed unnecessary personal access tokens, reducing credential exposure risk (CI-PERMS, CI-PAT, CI-PRTARGET). (#597)
security - SHA-pin github-script in post-failure-log composite action: Pinned github-script action to specific commit SHA to prevent supply-chain attacks via action version manipulation (CI-PIN). (#597)
security - Add E2EE mailbox caps, rotate-on-block, and device guards: Implemented mailbox size limits, automatic key rotation when users are blocked, and device-specific key guards to harden E2EE chat security (H-E2EE-2, M-E2EE-3, M-E2EE-5). (#597)
security
Update - 2026-06-13 19:13 UTC
Fixed
- Restore reCAPTCHA and Cloudflare beacon origins in web CSP: Fixed a regression where overly-strict Content Security Policy rules broke Firebase App Check (reCAPTCHA) and Cloudflare Web Analytics on the web app, preventing user login and venue loading in development. (#598)
bugsecurity
Security
- Harden VSCode editor token and GitHub quoting for Windows: Restricted VSCode editor token to header-only usage and improved GitHub command quoting to be Windows-safe, reducing token exposure surface and preventing shell injection risks across platforms. (#598)
security - Wire SCHEDULER_SECRET into venue-api deployment: Ensured the SCHEDULER_SECRET environment variable is properly injected during venue-api deployment, securing scheduled task authentication. (#598)
security
Update - 2026-06-13 20:48 UTC
Added
- Persistent live preview in Create Offer wizard: Merchants can now see a live phone preview while building offers in the Create Offer wizard, enabling real-time validation of how offers appear to end users. (#600)
enhancement
Changed
- Redesign Create Offer wizard to match Billing dashboard: The merchant portal's Create Offer wizard interior has been reskinned to align with the admin Billing dashboard design language, including new content cards and reworked Placements page for visual consistency. (#600)
enhancement
Update - 2026-06-13 23:27 UTC
Fixed
- Heal activeLanternCount drift and de-identify connectionId for pins: Resolves a regression where active lantern counts drifted out of sync and connection IDs were not properly de-identified in pin data, surfaced during browser-based security verification. (#599)
security - Stop service worker reloading on first install: Eliminates visual flicker caused by unnecessary service worker reloads during initial PWA installation. (#599)
security
Security
- Add OIDC-accepting shared guard and lanterns deploy wiring: Implements OIDC-aware authentication guards for the scheduler and wires lantern deployment to enforce identity verification, closing a gap in the authentication flow. (#599)
security - Align analytics /track entityType enum with shared ENTITY_TYPES: Fixes a validation mismatch where analytics endpoint was rejecting valid entity types, preventing 400 errors and ensuring consistent entity classification across the system. (#599)
security - Add null-safe Firestore guards and E2EE UserId-reuse fix: Hardens chat message handling with null-safety checks, fixes a potential UserId reuse vulnerability in end-to-end encryption, and enforces 90-day activity retention to limit exposure window. (#599)
security