Lantern

Appearance

Changelog - Dev - 06.17.2026 ​

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

[Unreleased] - 2026-06-17 ​

Added ​

  • E2EE device verification with safety numbers: Implements device-trust fingerprinting on per-device ed25519 keys to detect MITM attacks. Device key swaps or ghost devices now flip trust status to 'changed', and roomCrypto cross-checks live vs stored safety numbers to prevent plaintext downgrades and unauthorized message delivery. (#603) security
  • E2EE hardening with block exclusion and rate limits: Adds block-list exclusion checks and per-user claim rate limiting to prevent attackers from obtaining encryption keys for blocked users or flooding key-claim endpoints. (#603) security
  • Rate-limited server endpoint for to-device messages: Routes to-device message delivery through a server-side rate-limited endpoint to prevent silent drops and enforce consistent rate limits across instances, closing the no-ack-on-drop vulnerability. (#603) security
  • Durable cross-instance rate limiting and drop reporting: Implements persistent rate limit tracking across server instances and adds telemetry to report to-device message drops, enabling detection of delivery attacks. (#603) security
  • Server-side venue refresh lock with heartbeat: Moves venue metadata refresh locking from client to server with token-based fencing and heartbeat monitoring, preventing concurrent refresh races and geohash precision deduplication issues. (#603) security
  • Secret Manager migration finalization for dev: Completes Google Cloud Secret Manager migration for dev environment, retiring SCHEDULER_SECRET and establishing safe secret rotation procedures. (#603) security

Changed ​

  • Remove manual safety-number verification from chat UI: Simplifies E2EE UX by removing manual safety-number verification flows, now handled automatically through device-trust fingerprinting. (#603) security
  • Restrict offers to three placements, chat remains ad-free: Removes chat as an offer placement option, ensuring the chat experience remains ad-free and focused on user privacy. (#603) security
  • Update block modal copy to reflect self-serve unblock: Corrects user-facing messaging to accurately reflect that blocks can now be self-managed, removing outdated 'cannot be undone' language. (#603) security

Fixed ​

  • Repair gitleaks allowlist and address code review findings: Fixes inert gitleaks allowlist configuration and remediates multi-agent code review findings across E2EE, venue locking, rate limiting, and analytics. (#603) security
  • Allow maplibre blob worker in CSP for venues map: Updates Content Security Policy to permit maplibre blob workers, restoring venue map functionality. (#603) security
  • Stop silent analytics event drops and fix forge detection: Prevents analytics events from being silently dropped and corrects environment detection for forge deployments, ensuring event visibility. (#603) security
  • Land server forge events and deduplicate client flash: Enables server-side event logging for forge environments and removes duplicate client-side event flashing. (#603) security
  • Bootstrap derives project-id constants and refresh docs: Fixes bootstrap configuration to properly derive project-id constants and updates onboarding documentation. (#603) security
  • Clarify GOOGLE_APPLICATION_CREDENTIALS requires service account: Corrects environment documentation to specify that GOOGLE_APPLICATION_CREDENTIALS must reference a service account key, not Application Default Credentials. (#603) security

Removed ​

  • Remove chat placement from merchant offer form: Removes chat as an offer placement option from the merchant interface, backend schema, and ad render paths to keep chat ad-free. (#603) security

Security ​

  • Close device-trust MITM, no-ack-on-drop, block, and plaintext-downgrade holes: Comprehensive E2EE hardening that closes four critical attack vectors: MITM via device-key swaps, silent message drops without acknowledgment, key claims for blocked users, and plaintext fallback attacks. (#603) security
  • Document deferred M-E2EE-6 to-device relationship gate: Tracks deferred security work on relationship-based access control for to-device messages in the security tracker. (#603) security
  • Document SCHEDULER_SECRET deletion and retirement plan: Records SCHEDULER_SECRET deletion on dev (scheduled for 2026-06-16) and provides safe deletion script for secret retirement. (#603) security
  • Document custom-token and Stage B identity-sealing decision: Records privacy architecture decisions regarding custom token handling and identity-sealing in Stage B. (#603) security
  • Document OTP provider selection and testing approach: Clarifies OTP provider selection (Prelude) and documents free test numbers plus pay-as-you-go testing options for security validation. (#603) security
  • Consolidate E2EE hardening rollout and next steps: Centralizes E2EE security hardening progress and deferred work items in the security tracker for visibility and planning. (#603) security
  • Mark Firestore migration O4 complete on dev: Records completion of D1-D3 Firestore migration work on dev environment in the security tracker. (#603) security

Update - 2026-06-17 21:46 UTC ​

Added ​

  • Merchant dashboard with Account settings and offer review: Redesigned merchant dashboard information architecture with a new Account section (Profile, Business, Team, Security), offer review checklist, and progress-rail sidebar navigation. This continues the merchant offer-create workflow improvements and provides merchants with better organization of account management features. (#605) enhancement

Update - 2026-06-17 22:19 UTC ​

Fixed ​

  • Archive connection on block instead of failed delete: Blocking a user or removing a chat connection now archives the connection instead of attempting a client-side delete, which was denied by Firestore security rules. This resolves the issue where block and remove actions appeared to fail silently. (#604) bug
  • Relax CSP for bundled docs and storybook tooling: Updated Content Security Policy to allow bundled documentation and Storybook tooling to load properly in development environments. (#604) bug

Built with VitePress

Copyright © 2026 Lantern