scot/diligence
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
diligence/CHANGELOG.md
Claude 6e082ce58f Stream D: Security hardening — 10 fixes from QA review 
- SEC-05: Fail fast if SECRET_KEY is default 'change-me-in-production'
- SEC-06: CORS allow_credentials=False (Bearer tokens don't need it)
- SEC-08: Input validation on auth schemas (min/max length, username pattern)
- SEC-10: .dockerignore files (root, backend, mcp-connector)
- SEC-11: Hardcode ALGORITHM='HS256' as constant, remove from settings
- CQ-01: Gate crawl scheduler on CRAWL_ENABLED env var (default false)
- OS-02: CONTRIBUTING.md
- OS-03: CHANGELOG.md with v1.0.0 entry
- setup.ps1: Add API_TOKEN generation (Windows parity with setup.sh)
2026-06-21 23:13:53 +00:00

956 B
Raw Blame History

Changelog

All notable changes to Diligence are documented here.

[1.0.0] — 2026-06-18

Initial open-source release.

Features

  • Points economy with daily gate, weekly targets, weekly reset
  • Science-based onboarding (PAR-Q+, TTM, BREQ-2 motivation profiling)
  • Activity logging (manual + Strava OAuth + Polar OAuth sync)
  • Food logging with Open Food Facts barcode scanning + USDA FoodData Central
  • 90-day structured program tracking
  • Configurable reward shop
  • In-app support chat with Telegram notifications
  • 14-tool MCP connector for AI agent integration
  • Meal plan system with compliance tracking
  • Dynamic integration configuration (11 providers)
  • B2A discovery layer (llms.txt, agent-card.json, SKILL.md)

Security

  • Fernet-encrypted credential storage (HKDF key derivation)
  • Signed JWT OAuth state parameters
  • MCP connector authentication via API_TOKEN
  • First-user auto-admin grant
  • Traceback suppression in error responses