Files
SubMiner/changes/stats-request-safety.md
T
sudacode 122ff9a3c5 chore(release): prepare v0.20.0-beta.1
Trim pending change fragments, drop the breaking flag from the stats
request-safety change, and generate prerelease notes.
2026-09-22 01:29:58 -07:00

362 B

type: changed area: stats

  • The stats server now rejects requests from non-loopback hosts and browser origins and requires application/json for mutation bodies. The in-app stats overlay loads from the local server so it shares the same protection. Reverse-proxied or Tailscale Serve dashboards are unsupported; scripts that POST must set a JSON content type.