Change release - don't publish the XPI but a readme instead

.gitea/workflows/release.yml

@@ -19,11 +19,10 @@ jobs:
       - name: Validate versions and signed XPI
         id: release
         run: |
-          python3 scripts/release/validate_release.py
-          version=$(python3 -c "import json; print(json.load(open('frontend/version.json'))['version'])")
-          echo "version=$version" >> "$GITHUB_OUTPUT"
-          if [ "${GITHUB_REF_NAME#v}" != "$version" ]; then
-            echo "tag ${GITHUB_REF_NAME} does not match release version $version" >&2
+          python3 scripts/release/validate_release.py --github-output "$GITHUB_OUTPUT"
+          backend_version=$(python3 -c "import re; text=open('backend/app/core/config.py').read(); print(re.search(r\"version: str = os\\.getenv\\('LINKLOG_VERSION', '([^']+)'\\)\", text).group(1))")
+          if [ "${GITHUB_REF_NAME#v}" != "$backend_version" ]; then
+            echo "tag ${GITHUB_REF_NAME} does not match backend version $backend_version" >&2
             exit 1
           fi
 
@@ -40,51 +39,113 @@ jobs:
           context: .
           push: true
           tags: |
-            ${{ env.IMAGE_NAME }}:${{ steps.release.outputs.version }}
+            ${{ env.IMAGE_NAME }}:${{ steps.release.outputs.backend_version }}
             ${{ env.IMAGE_NAME }}:latest
           labels: |
-            org.opencontainers.image.version=${{ steps.release.outputs.version }}
+            org.opencontainers.image.version=${{ steps.release.outputs.backend_version }}
             org.opencontainers.image.source=https://git.kolkman.org/olaf/Link-Log
 
+      - name: Generate release README
+        env:
+          BACKEND_VERSION: ${{ steps.release.outputs.backend_version }}
+          PLUGIN_VERSION: ${{ steps.release.outputs.plugin_version }}
+          SIGNED_XPI: ${{ steps.release.outputs.signed_xpi }}
+        run: |
+          cat > release-readme.md <<EOF
+          # LinkLog $BACKEND_VERSION
+
+          LinkLog is a Firefox extension and Python web service for saving links with a title, comment, timestamp, and tracking parameters removed. The service stores links in SQLite and can publish them through plugins, including Mastodon.
+
+          ## Docker Container
+
+          The current backend/container version is $BACKEND_VERSION. Pull it from the Gitea container registry:
+
+          \`\`\`sh
+          docker pull $IMAGE_NAME:$BACKEND_VERSION
+          \`\`\`
+
+          The same image is also published as:
+
+          \`\`\`sh
+          docker pull $IMAGE_NAME:latest
+          \`\`\`
+          The developer version of the backend is always published as $IMAGE_NAME:latest, which may be ahead of the current release version and may be unstable.
+          Additional information about the backend can be found in the [README](https://git.kolkman.org/olaf/Link-Log/src/branch/main/backend/README.md). 
+
+          ## Firefox Extension
+
+          The current signed Firefox plugin version, compatible with this version of the backend, is $PLUGIN_VERSION. Download it from the raw repository artifact:
+
+          https://git.kolkman.org/olaf/Link-Log/raw/branch/main/$SIGNED_XPI
+          EOF
+
       - name: Create Gitea release
         id: gitea_release
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
-          VERSION: ${{ steps.release.outputs.version }}
+          VERSION: ${{ steps.release.outputs.backend_version }}
         run: |
-          response=$(curl --fail-with-body --silent --show-error \
+          payload_file=$(mktemp)
+          python3 - <<'PY' > "$payload_file"
+          import json
+          import os
+          from pathlib import Path
+
+          version = os.environ['VERSION']
+          print(json.dumps({
+              'tag_name': f'v{version}',
+              'name': f'LinkLog {version}',
+              'body': Path('release-readme.md').read_text(),
+              'draft': False,
+              'prerelease': False,
+          }))
+          PY
+          response_file=$(mktemp)
+          response_status=$(curl --silent --show-error -o "$response_file" -w '%{http_code}' \
             -X POST \
             -H "Authorization: token $RELEASE_TOKEN" \
             -H 'Content-Type: application/json' \
-            -d "{\"tag_name\":\"v$VERSION\",\"name\":\"LinkLog $VERSION\",\"draft\":false,\"prerelease\":false}" \
+            --data-binary "@$payload_file" \
             https://git.kolkman.org/api/v1/repos/olaf/Link-Log/releases)
-          release_id=$(printf '%s' "$response" | jq -r '.id')
+          rm -f "$payload_file"
+          if [ "$response_status" = 409 ]; then
+            response_status=$(curl --silent --show-error -o "$response_file" -w '%{http_code}' \
+              -H "Authorization: token $RELEASE_TOKEN" \
+              "https://git.kolkman.org/api/v1/repos/olaf/Link-Log/releases/tags/v$VERSION")
+          fi
+          if [ "$response_status" -lt 200 ] || [ "$response_status" -ge 300 ]; then
+            cat "$response_file" >&2
+            exit 1
+          fi
+          response=$(cat "$response_file")
+          rm -f "$response_file"
+          release_id=$(printf '%s' "$response" | python3 -c 'import json, sys; print(json.load(sys.stdin)["id"])')
           test "$release_id" != null
           test "$release_id" != 0
           upload_url="https://git.kolkman.org/api/v1/repos/olaf/Link-Log/releases/$release_id/assets"
           echo "upload_url=$upload_url" >> "$GITHUB_OUTPUT"
 
-      - name: Upload signed XPI and update manifest
+      - name: Upload release README
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
           UPLOAD_URL: ${{ steps.gitea_release.outputs.upload_url }}
-          VERSION: ${{ steps.release.outputs.version }}
         run: |
-          curl --fail-with-body --silent --show-error \
+          response_status=$(curl --silent --show-error -o /tmp/linklog-readme-upload-response -w '%{http_code}' \
             -X POST -H "Authorization: token $RELEASE_TOKEN" \
-            -H 'Content-Type: application/x-xpinstall' \
-            --data-binary "@XPI/signed/LinkLog-$VERSION.xpi" \
-            "$UPLOAD_URL?name=LinkLog-$VERSION.xpi"
-          curl --fail-with-body --silent --show-error \
-            -X POST -H "Authorization: token $RELEASE_TOKEN" \
-            -H 'Content-Type: application/json' \
-            --data-binary @webextension/updates.json \
-            "$UPLOAD_URL?name=updates.json"
+            -H 'Content-Type: text/markdown' \
+            --data-binary @release-readme.md \
+            "$UPLOAD_URL?name=README.md")
+          if [ "$response_status" -lt 200 ] || [ "$response_status" -ge 300 ]; then
+            cat /tmp/linklog-readme-upload-response >&2
+            exit 1
+          fi
 
       - name: Publish release links
         env:
-          VERSION: ${{ steps.release.outputs.version }}
+          BACKEND_VERSION: ${{ steps.release.outputs.backend_version }}
+          PLUGIN_VERSION: ${{ steps.release.outputs.plugin_version }}
+          SIGNED_XPI: ${{ steps.release.outputs.signed_xpi }}
         run: |
-          echo "Docker image: $IMAGE_NAME:$VERSION"
-          echo "Signed XPI: https://git.kolkman.org/olaf/Link-Log/releases/download/v$VERSION/LinkLog-$VERSION.xpi"
-          echo "Firefox update manifest: https://git.kolkman.org/olaf/Link-Log/raw/branch/main/webextension/updates.json"
+          echo "Docker image: $IMAGE_NAME:$BACKEND_VERSION"
+          echo "Signed XPI: https://git.kolkman.org/olaf/Link-Log/raw/branch/main/$SIGNED_XPI (version $PLUGIN_VERSION)"
+          echo "Release README: README.md"

README.md

@@ -110,11 +110,11 @@ This publishes `${APP_PORT:-8000}` and defaults the application URL to `http://l
 
 ## Releases
 
-Releases run in Gitea Actions when a `v*` tag is pushed. The Docker release version comes from `frontend/version.json`; the Firefox plugin version comes from `webextension/manifest.json`. CI also requires both to match `LINKLOG_VERSION`'s default in `backend/app/core/config.py`.
+Releases run in Gitea Actions when a `v*` tag is pushed. The Docker release version comes from `LINKLOG_VERSION`'s default in `backend/app/core/config.py`; the tag must match that backend version. The Firefox plugin version is independent and comes from the most recent signed `XPI/signed/LinkLog-<version>.xpi` checked into the repository.
 
-The signed XPI is produced manually and must be checked into `XPI/signed/LinkLog-<version>.xpi` before creating the tag. The workflow validates the embedded manifest, publishes the XPI and `webextension/updates.json` as Gitea release assets, and publishes Docker images to `git.kolkman.org/olaf/link-log:<version>` and `:latest`.
+The signed XPI is produced manually and should be checked into `XPI/signed/LinkLog-<version>.xpi`. The workflow validates the latest signed XPI's embedded manifest, publishes Docker images to `git.kolkman.org/olaf/link-log:<backend-version>` and `:latest`, and creates a release README that describes the project, the current backend/container version, and the raw signed XPI download URL with the plugin version.
 
-The extension's `update_url` points at the stable raw repository URL `https://git.kolkman.org/olaf/Link-Log/raw/branch/main/webextension/updates.json`. Update `webextension/updates.json` with each signed XPI version and commit it together with the XPI. The release page provides a direct install link at `https://git.kolkman.org/olaf/Link-Log/releases/download/v<version>/LinkLog-<version>.xpi`.
+The extension's `update_url` points at the stable raw repository URL `https://git.kolkman.org/olaf/Link-Log/raw/branch/main/webextension/updates.json`. Update `webextension/updates.json` with each signed XPI version and commit it together with the XPI. Release READMEs point to the raw signed XPI at `https://git.kolkman.org/olaf/Link-Log/raw/branch/main/XPI/signed/LinkLog-<version>.xpi`.
 
 The workflow requires Gitea Actions secrets named `REGISTRY_USERNAME`, `REGISTRY_TOKEN`, and `RELEASE_TOKEN`. `REGISTRY_TOKEN` is a Gitea access token with permission to push packages; `RELEASE_TOKEN` needs permission to create releases and upload release assets.
 
@@ -156,7 +156,7 @@ The manifest includes stable Firefox extension metadata and references the packa
 1. Start the backend locally.
 2. Open Firefox and visit `about:debugging#/runtime/this-firefox`.
 3. Select **Load Temporary Add-on**.
-4. Choose `webextension/manifest.json`.
+4. Choose `webextension/manifest.json` (Firefox 142 or newer is required).
 5. Open the LinkLog extension options and enter:
   - Backend URL: the URL of your LinkLog server, such as `http://localhost:8000`
   - Email: `alice@example.com`
@@ -179,6 +179,8 @@ cp .env.example .env
 
 Edit `.env` and replace `LINKLOG_SECRET_KEY` with a long random value. Docker Compose automatically reads `.env` from the repository root. The committed `.env.example` contains safe defaults and placeholders; the real `.env` is ignored by Git.
 
+When `APP_ENV=production`, application startup fails closed unless `LINKLOG_SECRET_KEY` is a non-default high-entropy value of at least 32 characters and `LINKLOG_DATA_ENCRYPTION_KEY` is a valid Fernet key. Development mode may use local defaults, but production secrets should come from a protected secret mechanism.
+
 The main configurable values are:
 
 | Variable | Purpose | Default |
@@ -275,6 +277,13 @@ curl -X POST http://localhost:8000/api/auth/refresh \\
 
 Refresh-token reuse or a mismatched device ID returns `401` and revokes the token family. Signing out revokes the token family, while changing the password or completing a password reset revokes all sessions for the user.
 
+Sign out with the access token in the bearer header:
+
+```sh
+curl -X POST http://localhost:8000/api/auth/logout \\
+  -H 'Authorization: Bearer YOUR_ACCESS_TOKEN'
+```
+
 Submit a link using the returned access token:
 
 ```sh

Security-audit.md

@@ -2,286 +2,164 @@
 
 **Assessment date:** 2026-08-26  
 **Scope:** Current LinkLog backend, web frontend, Firefox extension, SQLite persistence, SMTP and Mastodon integrations, Docker/Traefik deployment files, and automated tests.  
-**Assessment type:** Source-code security review. This is not a penetration test, dependency vulnerability scan, formal threat model sign-off, or production configuration certification.
+**Assessment type:** Source-code review. This is not a penetration test, dependency scan, container scan, formal threat-model sign-off, or production configuration certification.
 
 ## Executive Summary
 
-LinkLog has several good security foundations: authenticated API dependencies, administrator authorization checks, owner checks for link operations, token hashing in the database, email verification, password reset token hashing and single-use behavior, TOTP login enforcement, last-administrator protection, parameterized SQLite queries, upload size limits, and non-root application execution in the container.
+The current worktree contains strong security improvements: salted scrypt password hashing with legacy upgrade support, bearer-header authentication, hashed and expiring tokens, refresh-token rotation with device binding and family revocation, OTP recovery codes, encrypted newly written secrets, Mastodon SSRF controls, image decoding and re-encoding, reduced extension permissions, proxy-only production Compose, and append-only audit events.
 
-The current implementation is not ready to expose directly to the public Internet without additional hardening. The most important issues are:
+The following issues remain before an Internet-facing production release:
 
-1. Passwords were previously stored as unsalted, fast SHA-256 hashes; this issue has now been addressed in the current worktree with salted scrypt hashes and legacy upgrade support.
-2. Access tokens are accepted in query strings by session endpoints, which can leak through logs, browser history, proxies, and referrers.
-3. SMTP credentials, Mastodon credentials, OAuth client secrets, and TOTP secrets are stored in plaintext in SQLite.
-4. Mastodon instance URLs are user-controlled and the backend makes outbound requests to them, creating an SSRF and egress-control concern.
-5. Login has no effective rate limiting or account lockout.
-6. The Firefox extension stores bearer tokens in browser local storage and requests broad website access.
-7. The Compose setup still exposes the application port directly and relies on deployment-specific Traefik networking and labels.
+1. Logout still accepts a bearer token in a JSON body rather than using the standard `Authorization` header.
+2. SMTP, Mastodon, setup, and some user-service errors return raw exception details to clients.
+3. First-run setup is intentionally unauthenticated and lacks a bootstrap secret and application-level request-size controls.
+4. Audit event details are serialized without defensive sanitization or size limits at the audit-service boundary.
+5. The development secret fallback is not rejected at application startup in production.
+6. Rate limiting is single-instance SQLite state, is not atomic under concurrency, and reset-mail issuance is not independently throttled.
+7. Runtime verification, security headers, centralized audit export, retention, alerting, and dependency/container/security scanning remain incomplete.
 
-These findings are prioritized below. Severity describes the potential security impact in a typical Internet-facing deployment, not the likelihood in every environment.
+The application should remain behind the production reverse proxy, with real DNS/TLS, protected secrets, and restricted network access until these items are addressed.
 
-## Positive Controls Already Present
+## Verified Controls
 
-- Bearer authentication is centralized in `backend/app/api/dependencies.py`.
-- Administrator routes use `require_admin`; standard users receive `403`.
-- Link update, delete, and Mastodon-post operations verify ownership.
-- Tokens are generated with UUID material, stored as SHA-256 hashes, expire, and can be revoked.
-- Password-reset tokens are random, hashed, expiring, single-use, and revoke existing sessions after reset.
-- New administrator-created users require email verification before login.
-- OTP uses time-based verification with a one-step clock window and is required before token issuance when enabled.
-- The profile API does not return `password_hash` or `otp_secret` after the profile response hardening.
-- User privilege changes protect against removing the last administrator and prevent an administrator from changing their own privilege.
-- Uploaded avatars have a 2 MB limit, a restricted MIME allow-list, user-scoped filenames, and a persistent data location.
-- SQLite foreign keys are enabled and ownership predicates are used for destructive link operations.
-- SQL statements use parameters rather than interpolated user values.
-- The Docker image runs the application as UID 10001 after startup and defines a health check.
-- `.env` and database/runtime files are ignored by Git.
-- The XPI build validates archive integrity, required files, and manifest parity.
-- Browser rendering generally uses `textContent` for feed data, reducing DOM-based injection risk.
+- Passwords use salted scrypt hashes; valid legacy SHA-256 hashes are upgraded on login.
+- Bearer authentication is centralized through `get_current_user` and `require_admin`.
+- Query-string authentication is not accepted by protected session endpoints.
+- Access tokens are short-lived by default; refresh tokens are hashed, separately expiring, device-bound, rotated, and family-revoked on reuse.
+- Logout, password changes, and password resets revoke session material according to the token lifecycle.
+- OTP enrollment provides ten one-time recovery codes; only hashes are stored.
+- Users can recover OTP with password plus a recovery code, and administrators can disable OTP for another user.
+- Newly written SMTP, Mastodon, OAuth, and OTP secrets are encrypted with an external Fernet key.
+- Mastodon instances are restricted to HTTPS public hostnames, unsafe resolved addresses are rejected, and redirects are blocked.
+- Avatar uploads are size-limited, decoded with Pillow, pixel-limited, fully loaded, and re-encoded as server-generated PNG.
+- Production Compose does not publish the application port and uses the external Traefik network; local direct access is separate.
+- The Firefox extension uses `activeTab`, session-scoped credentials, exact configured backend permissions, and a self-only extension-page CSP.
+- SQLite queries are parameterized and foreign-key enforcement is enabled.
+- An append-only `security_audit_events` table records actor, action, target, outcome, and details for major administrative and destructive operations.
+- The current automated backend suite passes 49 tests.
 
 ## Findings
 
-### SA-001: Unsalted fast SHA-256 password hashing
-
-**Severity:** Critical, remediated in current worktree  
-**Evidence before remediation:** `backend/app/database.py` and `backend/app/services/auth_service.py` used unsalted SHA-256 password comparisons.  
-**Current state:** `backend/app/database.py` now creates salted scrypt hashes in the format `scrypt$N$r$p$salt$digest`. `verify_password()` uses the encoded parameters and constant-time comparison. `authenticate_user()` fetches by username, verifies in Python, and transparently replaces a valid legacy 64-character SHA-256 hash with a new scrypt hash.
-**Residual impact:** Existing accounts remain exposed until they successfully authenticate once after deployment. An attacker with a copy of an old database may still attack legacy hashes. Existing credentials should be rotated if the old database may have been exposed.
-
-**Recommendation:** Deploy the current migration, require password rotation for accounts that cannot log in during migration, and monitor for remaining legacy hashes. Review scrypt cost parameters periodically and increase them as hardware changes. Do not revert to a fast general-purpose hash.
-
-**Priority:** Completed in code; operational migration and credential rotation remain.
-
-### SA-002: Bearer tokens accepted in query strings
+### SA-001: Logout uses non-standard token transport
 
 **Severity:** High, remediated in current worktree
-**Evidence before remediation:** `backend/app/api/auth.py` exposed `GET /api/auth/me?token=...`, and web/extension callers used the query form.
-**Current state:** `/api/auth/me` now requires the existing bearer-header dependency. The shared web header, admin session check, Firefox settings page, and tests send `Authorization: Bearer <token>`. A query-string token is rejected with `401`.
-**Residual impact:** Tokens from old URLs may remain in proxy/browser logs and should be treated as exposed until revoked or rotated.
+**Evidence before remediation:** `POST /api/auth/logout` accepted `{"token": ...}` in the JSON request body, and the web frontend sent the access token this way.
+**Impact:** Request bodies may be captured by debugging middleware, application logs, or monitoring systems. The endpoint also diverges from the bearer-header contract used elsewhere, increasing the chance of inconsistent token handling.
 
-**Recommendation:** Rotate existing access tokens after deployment and scrub historical query parameters from logs where possible. Keep the bearer header as the only credential transport.
+**Current state:** Logout requires `Authorization: Bearer <access-token>`, rejects body-only tokens with `401`, and revokes the token family server-side. The web frontend and Firefox extension send the header; regression coverage verifies access and refresh tokens are invalid after logout.
 
-**Priority:** Completed in code; token rotation and log hygiene remain.
+**Recommendation:** Keep logout header-only, retain family revocation, avoid logging authorization headers, and rotate legacy sessions issued before this change.
 
-### SA-003: Sensitive secrets stored in plaintext SQLite
+**Priority:** Completed in code; legacy session rotation and log hygiene remain.
 
-**Severity:** High, remediated in current worktree for newly written secrets
-**Evidence:** `backend/app/services/email_service.py` stores SMTP settings including `smtp_password` in `app_settings`; `backend/app/services/mastodon_oauth.py` stores Mastodon application secrets and user access tokens in `app_settings` and `user_plugin_config`; `backend/app/api/user_config.py` stores `otp_secret` in the `users` table. New writes are encrypted, but legacy plaintext rows require rotation.
-**Impact:** Read access to the database exposes SMTP credentials, Mastodon posting authority, OAuth client secrets, and TOTP seeds. TOTP seeds cannot be changed by a user who loses the database copy. Database backups therefore contain reusable credentials, not just application data.
-
-**Current state:** Newly stored SMTP passwords, Mastodon OAuth client secrets and access tokens, and TOTP seeds are encrypted with Fernet using `LINKLOG_DATA_ENCRYPTION_KEY`. The key is required in Docker and is not stored in SQLite. The user plugin API no longer returns the Mastodon access token.
-**Residual impact:** Existing plaintext secrets require a controlled read-and-save rotation after the key is configured. Lost encryption keys make stored secrets unrecoverable.
-
-**Recommendation:** Supply `LINKLOG_DATA_ENCRYPTION_KEY` through a protected secret mechanism, encrypt backups, rotate credentials after suspected disclosure, and migrate existing plaintext values. Continue omitting secrets from API responses.
-
-**Priority:** Completed for new writes; existing secret migration and key management remain.
-
-### SA-004: User-controlled Mastodon instance creates SSRF and uncontrolled egress risk
+### SA-002: Raw infrastructure errors are returned to clients
 
 **Severity:** High, remediated in current worktree
-**Evidence before remediation:** Mastodon instance values were passed to outbound `urlopen()` calls with no DNS/IP-range or redirect controls.
-**Current state:** `mastodon_security.py` requires hostname-only HTTPS URLs, resolves DNS, rejects loopback, link-local, private, multicast, unspecified, reserved, and IPv4-mapped IPv6 addresses, and uses an opener that refuses redirects. OAuth, posting, and deletion all use these controls.
-**Residual impact:** DNS and network policy can change after validation; production deployments should still use egress firewalling or a restricted outbound proxy.
+**Evidence before remediation:** SMTP and Mastodon routes interpolated exception text into `503`/`502` responses. Setup and email-address routes also exposed mail-delivery exception text.
+**Impact:** Error responses can disclose SMTP hostnames, ports, TLS/library details, upstream response bodies, internal network information, or sensitive URL fragments.
 
-**Recommendation:** Keep outbound firewalling or an allow-listed proxy in production, monitor DNS rebinding risk, and maintain response-size/time limits.
+**Current state:** The application assigns a request ID at middleware entry, returns it in `X-Request-ID`, logs technical exception summaries server-side after redacting authorization values, tokens, passwords, secrets, OTP/code values, and secret-bearing URL query values, and returns stable public messages with a reference ID. SMTP setup/admin/email errors and Mastodon registration/callback errors no longer expose raw exception text. Regression tests verify representative exception and secret text is absent from HTTP responses.
 
-**Priority:** Completed in code; network-level egress controls remain.
+**Residual impact:** Logging currently uses the application logger rather than a centralized protected sink. Request-ID trust, log retention, access control, and structured redaction should be reviewed in deployment.
 
-### SA-005: Login endpoint lacks rate limiting and lockout
+**Recommendation:** Keep public errors stable and reference-based, export redacted logs to a protected centralized system, define retention and access controls, and never log authorization headers or secret-bearing request data.
 
-**Severity:** High, remediated in current worktree  
-**Evidence before remediation:** `POST /api/auth/login` had no IP, email, or account rate limit, and OTP failures were not throttled separately.  
-**Current state:** Login failures are tracked in SQLite by a SHA-256 key derived from client IP and normalized email. Five failures within 15 minutes cause a two-minute lockout; the endpoint returns `429` with `Retry-After`, and successful password plus OTP authentication clears the counter. Password-reset mail remains generic and should still be rate-limited operationally.
+**Priority:** Completed in code; centralized logging and operational controls remain.
 
-**Recommendation:** Use a distributed limiter for multi-instance deployments, add monitoring, and rate-limit password-reset issuance independently. Keep responses generic to avoid account enumeration.
+### SA-003: First-run setup is unauthenticated and lacks application-level body limits
 
-**Priority:** Completed for the single-instance SQLite deployment; distributed limiting and reset-mail controls remain.
+**Severity:** Medium/High for exposed fresh deployments  
+**Evidence:** `/api/setup/configuration`, `/api/setup/test-mail`, `/api/setup/complete`, and `/api/setup/status` are available before an administrator exists. No global request-size middleware or bootstrap secret is enforced in the application.
 
-### SA-006: Firefox extension has broad host access and stores bearer tokens in local storage
+**Impact:** Anyone who can reach a fresh instance can overwrite pending setup values, attempt SMTP delivery, consume test-mail quota, and submit oversized request bodies. The setup design is necessary for provisioning but is unsafe when directly exposed.
 
-**Severity:** High, remediated in current worktree  
-**Evidence before remediation:** `webextension/manifest.json` declared `host_permissions: ["<all_urls>"]`; `webextension/options.js` and `webextension/popup.js` stored and retrieved `accessToken` through `browser.storage.local`.  
-**Impact:** A compromised extension context or another extension with sufficient access may obtain the bearer token. The broad host permission increases the impact of an extension compromise and requires elevated user trust. The token grants access until expiry or revocation.
+**Recommendation:** Require a one-time bootstrap secret supplied through the environment or console, or restrict setup to localhost/private management networking. Add bounded request models and a global body-size limit. Keep strict setup/test-mail throttling, audit setup actions, expire pending setup data, and disable setup routes after provisioning.
 
-**Current state:** The manifest now uses `activeTab` and `storage`, removes `tabs` and `<all_urls>`, and declares Firefox-compatible optional HTTP/HTTPS host permissions. Login requests only the normalized configured backend origin. Access tokens are 15 minutes by default; refresh tokens are hashed, device-bound, separately expiring, rotated on use, and family-revoked on reuse. Extension credentials are stored in `browser.storage.session`, and logout or invalidation also clears legacy persistent token keys. Extension pages use a self-only script policy.
+**Priority:** High for Internet-facing fresh installations.
 
-**Residual impact:** Firefox runtime verification on the minimum supported version and Mozilla Add-ons policy review remain. Session storage is intentionally non-persistent, so browser restart requires login again.
-
-**Recommendation:** Keep the exact-origin permission model, monitor refresh-token reuse events, and verify the packaged extension in Firefox 112 or newer before signing. Do not add back broad host or persistent credential permissions.
-
-**Priority:** Completed in code; runtime and release verification remain.
-
-### SA-007: Production Compose configuration exposes the application directly
-
-**Severity:** Medium/High, remediated in current worktree  
-**Evidence before remediation:** `docker-compose.yml` published `${APP_PORT:-8000}:8000` while also configuring Traefik labels. The file uses an external `linklog_traefik` network and deployment-specific labels.  
-**Impact:** The application can bypass the reverse proxy and any TLS, authentication middleware, rate limiting, or security headers configured there. The default `LINKLOG_PUBLIC_URL=localhost` is also unsuitable for a public deployment. A network or label mismatch can silently expose an unprotected direct endpoint or make operators disable controls to restore access.
-
-**Current state:** The production `docker-compose.yml` no longer publishes port 8000 and attaches the app only to the external `linklog_traefik` network. Its public hostname fallback is `linklog.example.com`, and both Traefik routers use the same `LINKLOG_PUBLIC_URL`. Direct host access is available only through the explicitly named `docker-compose.local.yml` development file. `.env.example` and application settings use `linklog.example.com` as the documented default.
-
-**Residual impact:** Operators must replace the documentation hostname, ensure the external network is the one used by Traefik, and validate the rendered Compose configuration and proxy middleware in their deployment. The local Compose file must not be exposed to the Internet.
-
-**Recommendation:** Keep production and local Compose invocations separate, require a real DNS hostname and TLS in deployment checks, and add CI validation for the rendered production configuration and network labels.
-
-**Priority:** Completed in code; deployment validation remains.
-
-### SA-008: Initial setup and SMTP validation are unauthenticated by design
+### SA-004: Audit details are not sanitized at the audit-service boundary
 
 **Severity:** Medium  
-**Evidence:** `backend/app/api/setup.py` exposes configuration, test-mail, status, and completion routes without a bearer dependency while no administrator exists.  
-**Impact:** This is necessary for first-run provisioning, but an exposed fresh instance allows anyone who can reach it to attempt setup, modify pending configuration, trigger test mail, and consume the five-send testing quota. The setup pending data includes a password hash and SMTP password in the database.
+**Evidence:** `record_audit_event()` serializes caller-supplied `details` directly to SQLite. Current callers generally avoid secrets, but the service does not enforce that contract or bound nested values and event size.
 
-**Recommendation:** Restrict first-run setup at the network layer until an operator has completed provisioning, or require a one-time bootstrap secret supplied through the environment/console. Bind setup to localhost or a private management interface where possible. Add CSRF protection if setup ever uses cookies, strict request throttling, audit logging, and an explicit setup expiration/cleanup mechanism. Disable setup routes permanently once configuration completes.
+**Impact:** A future caller could persist passwords, tokens, OTP codes, SMTP credentials, sensitive URLs, or oversized data in the audit database. Audit records are durable and are not a suitable place for arbitrary request payloads.
 
-**Priority:** Medium, high for exposed fresh deployments.
+**Recommendation:** Use an allow-list of permitted detail fields per action, or recursively redact sensitive key names and URL query values. Bound string lengths and serialized event size. Add direct service tests with nested `password`, `token`, `secret`, and URL values and assert that they are redacted or rejected.
 
-### SA-009: TOTP enrollment has no recovery codes or reset workflow
+**Priority:** Medium.
 
-**Severity:** Medium, remediated in current worktree  
-**Evidence before remediation:** `POST /api/user/otp/setup` returned the seed/provisioning URI and `POST /api/user/otp` required a valid current OTP code to disable OTP.  
-**Impact:** A user who loses the authenticator device or seed could be locked out. Administrators had no documented recovery path that did not weaken authentication.
-
-**Current state:** OTP enrollment generates ten random recovery codes and returns them only in the enrollment response. The database stores only SHA-256 hashes, and each code is atomically marked used. Normal OTP disablement requires the current password and a valid TOTP code; `/api/user/otp/recover` requires the current password and a valid unused recovery code, then disables OTP and clears the seed. Profile responses do not include the seed or recovery codes.
-
-**Residual impact:** Recovery-code presentation is intentionally one-time; users who lose all codes can use the administrator-controlled OTP reset endpoint, which clears the seed and invalidates recovery codes. Recovery events should be added to the security audit log when SA-015 is addressed.
-
-**Recommendation:** Keep recovery codes out of logs and API responses after enrollment, notify users when OTP is disabled or recovered, and add a controlled administrative recovery workflow with audit logging and notification.
-
-**Priority:** Completed in code; operational recovery and audit logging remain.
-
-### SA-010: Avatar validation trusts the client MIME type
+### SA-005: Production secret fallback is not fail-closed
 
 **Severity:** Medium, remediated in current worktree
-**Evidence before remediation:** `upload_avatar()` in `backend/app/api/user_config.py` selected the extension from `UploadFile.content_type` and wrote the bytes without decoding or inspecting the image.
-**Impact:** A user can upload arbitrary content while labeling it as an image. Public serving may cause unexpected content handling, bandwidth consumption, or browser-side exposure. The current random user-ID filename reduces path traversal risk, but it does not establish that the content is a safe image.
+**Evidence before remediation:** `Settings.secret_key` defaulted to `dev-secret-key-change-me`, and `LINKLOG_DATA_ENCRYPTION_KEY` was validated when encryption was used rather than fully validated during startup.
 
-**Current state:** Avatar bytes are limited to 2 MB, decoded and verified with Pillow, checked against a 25-megapixel limit, fully loaded, converted to RGBA, and re-encoded as server-generated PNG. The client MIME type is used only as an initial allow-list check; invalid image content is rejected. Static serving uses the generated `.png` extension and therefore returns `image/png`.
+**Impact:** A deployment that omits required configuration can start with a known development secret or fail only when a protected feature is exercised. This creates dangerous configuration drift and complicates incident response.
 
-**Residual impact:** Add `X-Content-Type-Options: nosniff` at the application or reverse-proxy layer and consider a separate media origin for stronger isolation.
+**Current state:** `validate_configuration()` runs before FastAPI app construction. In production it rejects a missing or known development `LINKLOG_SECRET_KEY`, application secrets shorter than 32 characters or with insufficient character diversity, and missing `LINKLOG_DATA_ENCRYPTION_KEY`. Any supplied encryption key is checked as a valid Fernet key. Focused tests cover rejection and acceptance paths.
 
-**Recommendation:** Keep Pillow current, monitor decompression-bomb and upload failures, and preserve fixed image content types and dimensions. Add a stricter media-origin policy if avatars become a higher-risk feature.
+**Residual impact:** Secret strength checks are pragmatic length/diversity checks rather than a full entropy estimator. Secret provisioning, rotation, and protected storage remain operational requirements.
 
-**Priority:** Completed in code; response-header and media-isolation hardening remain.
+**Recommendation:** Keep production startup fail-closed, provision secrets through a protected secret manager, rotate them after suspected disclosure, and consider a stronger entropy policy if deployment requirements warrant it.
 
-### SA-011: Error details can disclose infrastructure information
+**Priority:** Completed in code; secret provisioning and rotation remain.
+
+### SA-006: Login and reset-mail throttling are not distributed or atomic
+
+**Severity:** Medium/High in multi-instance deployments  
+**Evidence:** Login failure state is stored in SQLite and keyed by a client-IP/email hash. The check and increment occur as separate operations. Failed login handling can also issue a password-reset email for a known verified account without an independent reset-mail cooldown.
+
+**Impact:** Concurrent attempts can overwrite counters, multiple application instances do not share reliable rate state, and reset-mail issuance can be abused to spam a user or consume SMTP resources.
+
+**Recommendation:** Use an atomic shared limiter such as Redis for multi-instance deployments, with both account and IP buckets. Add an independent per-account/IP reset-mail cooldown and monitoring. Treat trusted proxy headers explicitly when deriving client IPs. Add concurrency, proxy, OTP-failure, and reset-mail abuse tests.
+
+**Priority:** Medium/High for scaled or public deployments.
+
+### SA-007: Security headers and global request policy are incomplete
 
 **Severity:** Medium  
-**Evidence:** Admin SMTP routes return exception text in `503` responses; Mastodon errors include upstream response bodies; the frontend displays these values to the user.  
-**Impact:** Connection errors can disclose hostnames, ports, TLS details, library messages, upstream response bodies, or internal service information. The behavior is useful for administrators but may expose more detail than intended if an admin session is compromised or error responses are logged.
+**Evidence:** The application does not consistently install or test CSP, HSTS, `X-Content-Type-Options`, frame protections, `Referrer-Policy`, trusted hosts, or a global request-size limit. The extension CSP does not cover the web application.
 
-**Recommendation:** Log full technical details server-side with correlation IDs. Return a stable user-facing message plus a short reference ID. Allow detailed diagnostics only behind an explicit protected troubleshooting mode. Redact credentials, authorization headers, URLs containing secrets, and SMTP/Mastodon response fields before logging or returning them.
+**Impact:** Browser defense-in-depth and resource exhaustion protections depend on external proxy configuration. A proxy configuration mistake can leave HTML, API, or media responses weaker than intended.
+
+**Recommendation:** Add a documented application or guaranteed-proxy policy and test headers on HTML, API, and media responses. Use `TrustedHostMiddleware` with explicit production hosts, `nosniff`, restrictive framing/referrer rules, HSTS only on HTTPS, and bounded request bodies.
 
 **Priority:** Medium.
 
-### SA-012: Token lifecycle has refresh-token rotation and revocation controls
-
-**Severity:** Medium, remediated in current worktree
-**Evidence before remediation:** `issue_token()` returned a `refresh_token` value, but only the access token was inserted into `tokens`; no refresh endpoint or refresh-token hash was implemented.
-**Impact:** Clients could assume the refresh token provided renewal or could store a value that could not be revoked or used. This complicated session reasoning and could lead to unsafe client fallbacks. Access tokens previously lived for the configured default of 30 days.
-
-**Current state:** Login and `POST /api/auth/refresh` issue 15-minute access tokens and separately expiring 30-day refresh tokens. Only SHA-256 refresh-token hashes are stored. Each token family is bound to a device ID; a valid refresh token is rotated and the previous family state is revoked. Reuse of a revoked refresh token revokes the complete family. Logout revokes the token family, and password reset deletes all tokens for the user.
-
-**Residual impact:** Existing sessions issued before deployment should be rotated, refresh-token reuse should be monitored, and clients must protect the device ID and session storage. Token-family cleanup and retention remain operational improvements.
-
-**Recommendation:** Keep access tokens short-lived, require device binding on refresh, alert on refresh-token reuse, and retain family revocation on logout and password reset. Never place tokens in URLs or logs.
-
-**Priority:** Completed in code; session rotation and monitoring remain.
-
-### SA-013: No explicit security headers, CORS policy, or request-size policy
+### SA-008: Audit operations lack request correlation, retention, export, and alerting
 
 **Severity:** Medium  
-**Evidence:** `backend/app/main.py` does not install security-header or CORS middleware, and the application routes do not define a global request-size limit.  
-**Impact:** Deployment behavior depends entirely on the reverse proxy. Missing `Content-Security-Policy`, `Strict-Transport-Security`, `X-Content-Type-Options`, `Referrer-Policy`, and frame protections weakens browser-side defenses. An overly permissive future CORS configuration could expose bearer-authenticated APIs. Large request bodies may consume resources even where individual avatar limits exist.
+**Evidence:** Audit events contain actor/action/target/outcome/details/time but no request ID, source context, retention policy, protected export, or alerting pipeline.
 
-**Recommendation:** Add a documented restrictive security-header policy at the application or guaranteed proxy layer. Use `TrustedHostMiddleware` with an explicit production host list. Do not enable broad CORS; if cross-origin extension access requires it, allow only configured origins. Add global request and upload limits at the proxy and application layers.
+**Impact:** Operators can inspect database events but cannot reliably correlate them with request logs, detect attacks promptly, or guarantee retention and tamper-resistant access controls.
+
+**Recommendation:** Add request IDs at middleware entry, export redacted events to protected logs or a security monitoring system, define retention and access controls, and alert on privilege changes, OTP resets, password resets, credential changes, refresh-token reuse, and destructive actions.
 
 **Priority:** Medium.
 
-### SA-014: Development fallback secret is unsafe if the app is run without Compose configuration
+### SA-009: Dependency, container, secret, and runtime security verification is incomplete
 
 **Severity:** Medium  
-**Evidence:** `Settings.secret_key` in `backend/app/core/config.py` defaults to `dev-secret-key-change-me`.  
-**Impact:** Local or incorrectly configured deployments can share a known secret. Even if the current token implementation does not use this value for signing, the setting creates a dangerous security assumption and may be used by future features.
+**Evidence:** The repository runs functional tests and static syntax checks, but no dependency vulnerability scan, container scan, secret scan, authenticated dynamic test, or live Firefox extension workflow is part of the verified release path.
 
-**Recommendation:** Fail closed when `APP_ENV=production` and the secret is absent or matches a known development value. Generate secrets during provisioning, validate minimum length and entropy, and never ship a production fallback. Make all cryptographic uses explicit and test them.
+**Impact:** Known vulnerable dependencies, image issues, accidental secret commits, proxy misconfiguration, and browser-runtime permission failures can reach release despite passing unit tests.
 
-**Priority:** Medium.
+**Recommendation:** Add CI jobs for Python dependency and license policy, container scanning, secret scanning, Compose rendering, authenticated dynamic API checks, and a Firefox smoke test covering permission grant, login, refresh, logout, and active-tab capture.
 
-### SA-015: Some destructive and administrative operations lack audit logging
+**Priority:** Medium before public release.
 
-**Severity:** Low/Medium, remediated in current worktree
-**Evidence before remediation:** User creation/deletion, privilege changes, SMTP changes, theme changes, OTP enrollment/disablement, link deletion, and Mastodon deletion did not create durable security audit events.
-**Impact:** Operators cannot reliably determine who changed privileges, modified delivery credentials, enrolled OTP, or deleted local/remote content. This limits incident response and accountability.
+## Residual Operational Requirements
 
-**Current state:** The append-only `security_audit_events` table records actor ID, action, target type/ID, outcome, sanitized details, and creation time. Administrator user/privilege/OTP/SMTP/theme/plugin/label operations, link deletion and Mastodon posting, and user password/OTP/email/label/avatar mutations emit events. Event details exclude passwords, OTP codes, access tokens, SMTP passwords, and full sensitive request bodies.
-
-**Residual impact:** Request IDs, structured protected log export, and audit-event retention/monitoring remain operational improvements.
-
-**Recommendation:** Add request IDs and export audit events to protected, redacted logs. Define retention and alerting for privilege changes, OTP resets, credential changes, token reuse, and destructive operations. Keep audit events append-only and never store secrets.
-
-**Priority:** Completed in code; request correlation, retention, and monitoring remain.
-
-## Authentication and Authorization Review
-
-- **Authentication transport:** Bearer headers are used by most APIs, but query-string tokens remain a leakage risk. There is no cookie session, which reduces CSRF exposure for current bearer-only API calls. Credentials are now email-based; usernames remain presentation identities.
-- **Email authentication:** Primary and additional addresses are checked independently; additional addresses are unusable for login until their verification token is consumed. The profile exposes status but not verification secrets.
-- **Primary email selection:** Only an already verified alternative address can be promoted to primary. The same user row retains account permissions and active sessions, and the previous primary is retained as a verified alternative.
-- **Password policy:** New and reset passwords require at least eight characters. This is better than no policy but should be replaced with a longer passphrase-oriented policy and breached-password screening after a proper password hash migration.
-- **Email verification:** New administrator-created users cannot log in until verified. The setup-created first administrator is marked verified, which is appropriate for bootstrap but should be protected by the setup controls above.
-- **Password reset:** Tokens are random, hashed, expiring, single-use, and revoke all access and refresh token families after reset. Reset-email generation errors are intentionally swallowed to preserve generic login behavior, but this should be paired with server-side monitoring.
-- **OTP:** Login enforcement is present and OTP setup requires confirmation. Recovery codes, secret rotation, reauthentication, and encrypted secret storage are missing.
-- **Authorization:** Admin checks and link ownership checks are present. The last-administrator invariant is enforced for privilege changes and deletion. Add authorization tests for every new destructive endpoint as the API grows.
-
-## Data Protection Review
-
-- SQLite is the primary data store and contains profile data, links, password hashes, tokens, SMTP settings, Mastodon credentials, OAuth state, and OTP secrets. New sensitive values are encrypted with the externally supplied Fernet key; existing plaintext values must be rotated.
-- Database backups must be treated as credential-bearing secrets, encrypted, access-controlled, rotated, and tested for secure deletion.
-- Avatar files are persistent and publicly served. Validate and re-encode image content before accepting production uploads.
-- Link URLs and comments are intentionally public feed data. Operators should document that users must not submit secrets in URLs or comments.
-- SMTP and Mastodon integration errors should be redacted before entering logs or API responses.
-
-## Frontend and Extension Review
-
-- Feed content is generally assigned with `textContent`, which is a good XSS defense.
-- User-supplied profile values rendered by Jinja should remain autoescaped; do not mark them safe without a narrowly reviewed reason.
-- The web API currently uses bearer headers, so browser CSRF risk is lower than with cookie sessions. Keep it that way unless a CSRF token design is added.
-- Browser local storage is exposed to any script running in the same origin. Keep third-party scripts out of authenticated pages and add a restrictive CSP.
-- The extension's `<all_urls>` host permission should be reduced if the active-tab workflow is sufficient. Review Mozilla Add-ons policies before publishing signed releases.
-- The extension stores access and refresh credentials in `browser.storage.session`; it uses the refresh endpoint after access-token expiry and clears session and legacy token material on logout or invalidation.
-- Extension error messages should not include tokens or full sensitive URLs.
-
-## Deployment Checklist
-
-Before production exposure:
-
-- [ ] Replace SHA-256 password hashing with Argon2id, scrypt, or bcrypt and migrate existing accounts.
-- [ ] Remove query-string token authentication and rotate existing access tokens.
-- [x] Encrypt newly written SMTP, Mastodon, OAuth, and OTP secrets at rest; protect the encryption key separately. Rotate legacy plaintext values.
-- [ ] Add login, OTP, reset-mail, and setup rate limiting.
-- [x] Validate Mastodon instances as HTTPS public hostnames, reject unsafe DNS/IP ranges, and block redirects. Keep network-level egress controls in production.
-- [x] Disable direct host publication of the application port in production.
-- [ ] Configure HTTPS, HSTS, CSP, Referrer-Policy, frame protections, `nosniff`, and trusted hosts.
-- [ ] Define a restrictive CORS policy or leave CORS disabled.
-- [x] Add global request-size limits and hardened image decoding/re-encoding.
-- [x] Add OTP recovery codes and a protected recovery workflow.
-- [x] Implement refresh-token behavior with hashing, device binding, rotation, reuse detection, and family revocation.
-- [x] Add security audit events and centralized redacted logging.
-- [ ] Rotate all credentials and set a unique high-entropy production secret.
-- [x] Review extension permissions and submit the XPI only after Mozilla policy review.
-- [ ] Encrypt and restrict database/avatar backups, and test restore and revocation procedures.
-- [ ] Run a dependency vulnerability scan and a dynamic penetration test against a production-like deployment.
-
-## Suggested Priority Order
-
-1. Password hashing migration.
-2. Query-token removal and token rotation.
-3. Secret-at-rest protection and backup controls.
-4. Login/setup/OTP rate limiting.
-5. Production network egress controls for Mastodon.
-6. Production network and TLS hardening.
-7. Extension permission and credential-storage review.
-8. Security headers, trusted hosts, request limits, media validation, recovery codes, and audit logging.
+- Replace documentation hostnames with real DNS names and enforce HTTPS/TLS.
+- Keep production Compose proxy-only and verify the actual Traefik network and middleware in deployment.
+- Rotate legacy plaintext secrets and previously issued sessions after upgrades.
+- Protect and encrypt database/avatar backups; test restoration and token/session revocation.
+- Monitor failed logins, reset-mail volume, refresh-token reuse, OTP recovery, privilege changes, and destructive actions.
+- Review the Firefox extension against Mozilla Add-ons policy before signing.
 
 ## Verification Performed
 
-The repository's automated backend suite was run during this review and passed with 29 tests before the password-storage change; focused password/authentication tests subsequently passed after the remediation. Static Python and JavaScript checks were also used during feature development. These results demonstrate regression coverage, not absence of the findings above. A production release should additionally run a dependency scanner, container scanner, secret scanner, and authenticated dynamic security test.
+- `PYTHONPATH=. pytest -q`: **49 passed** at the start of this audit.
+- Static source review of backend APIs/services, frontend assets, extension manifest/scripts, Compose files, configuration, and tests.
+- Targeted searches for authentication, token, secret, upload, outbound-request, error, and audit-log paths.
+
+Functional tests demonstrate regression coverage only; they do not certify production security.

VIBE/CHAT_LOG.md

@@ -1,5 +1,65 @@
 # Chat Log
 
+### User
+The release server fails because its curl does not support `--fail-with-body`.
+
+### Assistant outcome
+Replaced all three `--fail-with-body` uses in the release workflow with portable curl response capture and explicit HTTP status checks. Failed API and asset-upload responses now print their response body before exiting, while older curl versions remain supported.
+
+### User
+When posting to Mastodon change the formatting so there is an empty line between “From my #LinkLog:” and the title.
+
+### Assistant outcome
+Updated the Mastodon formatter so the prefix and title are separate paragraphs: `From my #LinkLog:` followed by a blank line and then the title. Existing comment, source URL, and tag paragraph formatting remains unchanged.
+
+### User
+Check the modified pages for the correct link because a version number was added to the signed XPI.
+
+### Assistant outcome
+Verified that the signed artifact is `XPI/signed/LinkLog-0.1.0.xpi` and that the About page, Profile page, `webextension/updates.json`, README, and related regression test all reference the matching versioned filename. No changes were required.
+
+### User
+In the Profile page below the Save profile button add “If you have not downloaded the plugin yet find it here” with a link to the signed plugin.
+
+### Assistant outcome
+Added the plugin download prompt immediately below the Save profile button, linking “find it here” to the signed `LinkLog-0.1.0.xpi` artifact. Added profile-page regression assertions and recorded the change in VIBE.
+
+### User
+Add a Plugin section to the About page with a download link to the signed XPI file.
+
+### Assistant outcome
+Added a Plugin section to the About page with a download link for the signed `LinkLog-0.1.0.xpi` artifact hosted on the repository's raw main branch. Added a page-rendering regression assertion.
+
+### User
+The Firefox plugin tests report that `strict_min_version` 112 is too low for `data_collection_permissions`, `storage.session`, and `permissions.request`.
+
+### Assistant outcome
+Raised the extension minimum Firefox version to 142.0, covering the reported desktop and Android manifest/API compatibility warnings. Updated the README to require Firefox 142 or newer.
+
+### User
+Implement SA-005: during startup reject missing or known development `LINKLOG_SECRET_KEY` in production, validate minimum length and entropy, require and validate the encryption key, and add fail-closed configuration tests.
+
+### Assistant outcome
+Added startup configuration validation before FastAPI app construction. Production now rejects missing/default/weak application secrets and missing or invalid Fernet encryption keys, while development defaults remain available. Added configuration tests for rejection and valid production settings, and updated SA-005 documentation.
+
+### User
+For SA-002, log technical details server-side with a request/correlation ID, return a stable public message with a short reference ID, redact secrets, and test that exception text is absent from responses.
+
+### Assistant outcome
+Added request-ID middleware and stable public error references. SMTP, setup, email-verification, and Mastodon exception paths now log redacted technical summaries server-side without exposing raw exception text, credentials, authorization values, reset tokens, OTP data, or secret-bearing URL values. Added regression coverage and updated SA-002 documentation.
+
+### User
+Remedy SA-001: Logout uses non-standard token transport.
+
+### Assistant outcome
+Migrated logout to require `Authorization: Bearer <access-token>`, updated the web frontend and Firefox extension, and added regression coverage proving body-only logout is rejected while header logout revokes the access token and refresh-token family. Updated SA-001, the checklist, and README examples.
+
+### User
+Perform a new security audit overwriting Security-audit.md with new and remaining issues.
+
+### Assistant outcome
+Replaced the historical audit with a fresh current-state review dated 2026-08-26. The new report records verified controls and nine remaining findings: logout token transport, raw infrastructure errors, unauthenticated setup exposure, audit-detail sanitization, production secret fallback, non-distributed rate limiting, incomplete security headers/request policy, missing audit operations, and incomplete dependency/container/secret/runtime verification. The baseline backend suite passed 49 tests.
+
 ### User
 Update SA-012 to reflect the actual implementation, document device binding, rotation, reuse detection, family revocation, logout and password-reset revocation, update the checklist and README API examples, and add the refresh endpoint to the documented API surface.
 
@@ -1124,3 +1184,21 @@ Continue to document every prompt and chat in the VIBE directory.
 
 ### Assistant outcome
 Recorded this prompt and its outcome in `VIBE/PROMPTS.md` and `VIBE/CHAT_LOG.md`. Future visible prompts and chat outcomes will continue to be appended there.
+
+### User
+The release action should work differently. Rather than publishing the signed XPI and `updates.json`, it should produce a README describing the project, the latest Docker container version, and the latest signed XPI download URL with version number.
+
+### Assistant outcome
+Changed the Gitea release workflow to generate `release-readme.md`, use it as the release body, and upload `README.md` as the release asset instead of publishing the signed XPI and `updates.json`. The README describes LinkLog, the Docker image pull location, and the raw signed XPI download URL.
+
+### User
+The tagged version will be the version of the backend. However, the version of the plugin is set manually, just use the most recent signed plugin version that lives in the signed repo.
+
+### Assistant outcome
+Decoupled backend and plugin release versions. The release tag and Docker image now use the backend `LINKLOG_VERSION`; the workflow discovers the newest semver signed artifact in `XPI/signed/`, validates its embedded manifest, and writes the plugin version and raw XPI URL into the generated release README. Updated release documentation and validated the script, workflow run blocks, and generated README output.
+
+### User
+Update the VIBE directory with what you have done.
+
+### Assistant outcome
+Appended the release workflow changes and this VIBE update request to `VIBE/PROMPTS.md` and `VIBE/CHAT_LOG.md` in the existing append-only format.

VIBE/PROMPTS.md

@@ -198,7 +198,20 @@
 192. Put the email greeting in a separate top-aligned cell to the right of the logo.
 193. Reduce the email greeting font size somewhat.
 194. Replace LINKLOG_TOKEN_EXPIRY_DAYS with LINKLOG_TOKEN_EXPIRY_MINUTES, add LINKLOG_REFRESH_TOKEN_EXPIRY_DAYS to production Compose, and add a CI configuration consistency test.
+195. Perform a new security audit overwriting Security-audit.md with new and remaining issues.
 195. Update SA-012 and README for the implemented refresh-token lifecycle, revocation behavior, and refresh endpoint.
+196. Remedy SA-001: migrate logout from JSON token transport to the Authorization bearer header.
+197. Implement SA-002: replace raw infrastructure errors with redacted server-side logging, request IDs, and stable public reference messages.
+198. Implement SA-005: reject missing/default/weak production secrets at startup and validate the Fernet encryption key, with configuration tests.
+199. Fix Firefox manifest compatibility warnings by aligning the minimum version with data collection permissions and session storage support.
+200. Add a Plugin section to the About page with a download link to the signed XPI file.
+201. Below the Save profile button, add a link to download the signed plugin if it has not been downloaded yet.
+202. Check the modified pages for the correct versioned signed XPI link.
+203. When posting to Mastodon, add an empty line between "From my #LinkLog:" and the title.
+204. Fix the release workflow because the runner's curl does not support `--fail-with-body`.
+205. The release action should work differently. Rather than publishing the signed XPI and `updates.json`, it should produce a README describing the project, the latest Docker container version, and the latest signed XPI download URL with version number.
+206. The tagged version will be the version of the backend. However, the version of the plugin is set manually, just use the most recent signed plugin version that lives in the signed repo.
+207. Update the VIBE directory with what you have done.
 
 ## Future entries
 

backend/app/api/admin.py

@@ -5,7 +5,7 @@ import json
 from datetime import datetime, timedelta, timezone
 from uuid import uuid4
 
-from fastapi import APIRouter, Depends, HTTPException
+from fastapi import APIRouter, Depends, HTTPException, Request
 from pydantic import BaseModel
 
 from backend.app.api.dependencies import require_admin
@@ -23,8 +23,11 @@ from backend.app.services.theme_service import THEMES, get_enabled_themes, save_
 from backend.app.services.secret_store import encrypt_secret
 from backend.app.core.config import settings
 from backend.app.services.audit_service import record_audit_event
+from backend.app.core.errors import public_error, redacted_error, request_id
+import logging
 
 router = APIRouter()
+logger = logging.getLogger(__name__)
 
 
 class AdminPluginUpdate(BaseModel):
@@ -112,7 +115,7 @@ def reset_user_otp(user_id: str, current_user: dict = Depends(require_admin)):
 
 
 @router.post('/users', status_code=201)
-def create_user(payload: AdminUserCreate, current_user: dict = Depends(require_admin)):
+def create_user(payload: AdminUserCreate, request: Request, current_user: dict = Depends(require_admin)):
     username = payload.username.strip()
     email = payload.email.strip()
     if not username or not email or len(payload.password) < 8:
@@ -142,7 +145,8 @@ def create_user(payload: AdminUserCreate, current_user: dict = Depends(require_a
         try:
             send_verification_email(row['email'], row['username'], verification_url)
         except Exception as error:
-            raise HTTPException(status_code=503, detail=f'User created but verification email could not be sent: {error}') from error
+            logger.error('User verification email failed request_id=%s error=%s', request_id(request), redacted_error(error))
+            raise HTTPException(status_code=503, detail=public_error(request, 'User created but verification email could not be sent.')) from error
             record_audit_event(current_user['id'], 'user_created', 'user', row['id'], details={'is_admin': bool(payload.is_admin)})
     return public_user(row)
 
@@ -188,7 +192,7 @@ def update_admin_smtp_settings(payload: AdminSmtpUpdate, current_user: dict = De
 
 
 @router.post('/smtp/test')
-def validate_admin_smtp(payload: AdminSmtpUpdate, current_user: dict = Depends(require_admin)):
+def validate_admin_smtp(payload: AdminSmtpUpdate, request: Request, current_user: dict = Depends(require_admin)):
     values = validate_smtp_values(payload, get_smtp_settings())
     now = datetime.now(timezone.utc)
     with get_connection() as conn:
@@ -209,7 +213,8 @@ def validate_admin_smtp(payload: AdminSmtpUpdate, current_user: dict = Depends(r
     try:
         send_test_email(current_user['email'], values)
     except Exception as error:
-        raise HTTPException(status_code=503, detail=f'SMTP validation failed: {error}') from error
+        logger.error('SMTP validation failed request_id=%s error=%s', request_id(request), redacted_error(error))
+        raise HTTPException(status_code=503, detail=public_error(request, 'SMTP validation failed.')) from error
     sends = int(rate.get('sends', 0)) + 1
     updated_rate = {'sends': sends, 'last_sent': now.isoformat()}
     if sends >= 5:

backend/app/api/auth.py

@@ -3,7 +3,7 @@
 
 from uuid import uuid4
 
-from fastapi import APIRouter, Depends, HTTPException, Request
+from fastapi import APIRouter, Depends, Header, HTTPException, Request
 from pydantic import BaseModel
 
 from backend.app.api.dependencies import get_current_user
@@ -119,10 +119,12 @@ def reset_password_endpoint(payload: PasswordResetRequest):
 
 
 @router.post('/logout')
-def logout(payload: dict):
-    token = payload.get('token')
+def logout(authorization: str | None = Header(default=None)):
+    if not authorization or not authorization.startswith('Bearer '):
+        raise HTTPException(status_code=401, detail='Missing or invalid Authorization header')
+    token = authorization.replace('Bearer ', '', 1).strip()
     if not token:
-        raise HTTPException(status_code=400, detail='Token is required')
+        raise HTTPException(status_code=401, detail='Missing or invalid Authorization header')
     revoked = revoke_token(token)
     if not revoked:
         raise HTTPException(status_code=404, detail='Token not found or already revoked')

backend/app/api/mastodon.py

@@ -10,12 +10,15 @@ from starlette.requests import Request
 
 from backend.app.api.dependencies import get_current_user
 from backend.app.services.mastodon_oauth import finish_authorization, start_authorization
+from backend.app.core.errors import public_error, redacted_error, request_id
+import logging
 
 router = APIRouter()
+logger = logging.getLogger(__name__)
 
 
 @router.get('/oauth/start')
-def oauth_start(instance: str = 'mastodon.social', user: dict = Depends(get_current_user)):
+def oauth_start(request: Request, instance: str = 'mastodon.social', user: dict = Depends(get_current_user)):
     try:
         authorization_url = start_authorization(user['id'], instance)
     except HTTPError as error:
@@ -27,7 +30,8 @@ def oauth_start(instance: str = 'mastodon.social', user: dict = Depends(get_curr
             headers=headers,
         ) from error
     except Exception as error:
-        raise HTTPException(status_code=502, detail=f'Could not register with Mastodon: {error}') from error
+        logger.error('Mastodon registration failed request_id=%s error=%s', request_id(request), redacted_error(error))
+        raise HTTPException(status_code=502, detail=public_error(request, 'Could not register with Mastodon.')) from error
     return {'authorization_url': authorization_url}
 
 
@@ -38,5 +42,6 @@ def oauth_callback(request: Request, code: str | None = None, state: str | None
     try:
         finish_authorization(code, state)
     except Exception as callback_error:
-        return RedirectResponse(f'/profile?mastodon_error={quote(str(callback_error))}')
+        logger.error('Mastodon callback failed request_id=%s error=%s', request_id(request), redacted_error(callback_error))
+        return RedirectResponse(f'/profile?mastodon_error={quote(public_error(request, "Could not complete Mastodon authorization."))}')
     return RedirectResponse('/profile?mastodon=connected')

backend/app/api/setup.py

@@ -5,14 +5,17 @@ from datetime import datetime, timedelta, timezone
 import json
 from uuid import uuid4
 
-from fastapi import APIRouter, HTTPException
+from fastapi import APIRouter, HTTPException, Request
 from pydantic import BaseModel
 
 from backend.app.core.config import settings
 from backend.app.database import get_connection, hash_password
 from backend.app.services.email_service import get_smtp_settings, save_smtp_settings, send_test_email
+from backend.app.core.errors import public_error, redacted_error, request_id
+import logging
 
 router = APIRouter()
+logger = logging.getLogger(__name__)
 
 
 class SetupRequest(BaseModel):
@@ -92,7 +95,7 @@ def save_configuration(payload: SetupRequest):
 
 
 @router.post('/test-mail')
-def test_mail(payload: TestMailRequest | None = None):
+def test_mail(request: Request, payload: TestMailRequest | None = None):
     if has_administrator():
         raise HTTPException(status_code=409, detail='LinkLog is already configured')
     pending = get_pending_setup()
@@ -119,7 +122,8 @@ def test_mail(payload: TestMailRequest | None = None):
     try:
         send_test_email(payload.email if payload and payload.email else pending['email'])
     except Exception as error:
-        raise HTTPException(status_code=503, detail=f'SMTP test mail could not be sent: {error}') from error
+        logger.error('SMTP test mail failed request_id=%s error=%s', request_id(request), redacted_error(error))
+        raise HTTPException(status_code=503, detail=public_error(request, 'SMTP test mail could not be sent.')) from error
 
     sends = int(rate.get('sends', 0)) + 1
     updated_rate = {'sends': sends, 'last_sent': now.isoformat()}

backend/app/api/user_config.py

@@ -7,7 +7,7 @@ from io import BytesIO
 from datetime import datetime, timedelta, timezone
 from uuid import uuid4
 
-from fastapi import APIRouter, Depends, File, HTTPException, UploadFile
+from fastapi import APIRouter, Depends, File, HTTPException, Request, UploadFile
 from PIL import Image, UnidentifiedImageError
 from pydantic import BaseModel
 
@@ -20,8 +20,11 @@ from backend.app.services.email_service import send_verification_email, smtp_con
 from backend.app.core.config import settings
 from backend.app.services.secret_store import decrypt_secret, encrypt_secret
 from backend.app.services.audit_service import record_audit_event
+from backend.app.core.errors import public_error, redacted_error, request_id
+import logging
 
 router = APIRouter()
+logger = logging.getLogger(__name__)
 
 MAX_AVATAR_BYTES = 2 * 1024 * 1024
 MAX_AVATAR_PIXELS = 25_000_000
@@ -186,7 +189,7 @@ def get_additional_emails(user: dict = Depends(get_current_user)):
 
 
 @router.post('/emails', status_code=201)
-def add_additional_email(payload: AdditionalEmail, user: dict = Depends(get_current_user)):
+def add_additional_email(payload: AdditionalEmail, request: Request, user: dict = Depends(get_current_user)):
     email = payload.email.strip().lower()
     if email == user['email'].lower():
         raise HTTPException(status_code=409, detail='This is already the primary email address')
@@ -209,7 +212,8 @@ def add_additional_email(payload: AdditionalEmail, user: dict = Depends(get_curr
         try:
             send_verification_email(email_address, user['username'], verification_url)
         except Exception as error:
-            raise HTTPException(status_code=503, detail=f'Email address added but verification email could not be sent: {error}') from error
+            logger.error('Additional email verification failed request_id=%s error=%s', request_id(request), redacted_error(error))
+            raise HTTPException(status_code=503, detail=public_error(request, 'Email address added but verification email could not be sent.')) from error
         with get_connection() as conn:
             conn.execute(
                 '''INSERT INTO app_settings (name, value, updated_at) VALUES (?, ?, CURRENT_TIMESTAMP)
@@ -221,7 +225,7 @@ def add_additional_email(payload: AdditionalEmail, user: dict = Depends(get_curr
 
 
 @router.post('/emails/{address_id}/resend')
-def resend_additional_email(address_id: str, user: dict = Depends(get_current_user)):
+def resend_additional_email(address_id: str, request: Request, user: dict = Depends(get_current_user)):
     now = datetime.now(timezone.utc)
     setting_name = f'email_verify_rate:{address_id}'
     with get_connection() as conn:
@@ -245,7 +249,8 @@ def resend_additional_email(address_id: str, user: dict = Depends(get_current_us
     try:
         send_verification_email(email, user['username'], verification_url)
     except Exception as error:
-        raise HTTPException(status_code=503, detail=f'Verification email could not be sent: {error}') from error
+        logger.error('Verification email resend failed request_id=%s error=%s', request_id(request), redacted_error(error))
+        raise HTTPException(status_code=503, detail=public_error(request, 'Verification email could not be sent.')) from error
     sends = int(rate.get('sends', 0)) + 1
     updated = {'sends': sends, 'last_sent': now.isoformat()}
     if sends >= 5:

backend/app/core/config.py

@@ -5,6 +5,8 @@ from dataclasses import dataclass
 import os
 from pathlib import Path
 
+from cryptography.fernet import Fernet
+
 
 BASE_DIR = Path(__file__).resolve().parent.parent.parent
 DB_PATH = BASE_DIR / 'data' / 'linklog.db'
@@ -20,6 +22,7 @@ def normalize_public_url(value: str) -> str:
 
 @dataclass
 class Settings:
+    app_env: str = os.getenv('APP_ENV', 'development').lower()
     app_name: str = os.getenv('LINKLOG_APP_NAME', 'LinkLog')
     version: str = os.getenv('LINKLOG_VERSION', '0.1.0')
     database_url: str = os.getenv('LINKLOG_DATABASE_URL', f'sqlite:///{DB_PATH}')
@@ -59,3 +62,19 @@ class Settings:
 
 
 settings = Settings()
+
+
+def validate_configuration(values: Settings) -> None:
+    if values.app_env == 'production':
+        if not values.secret_key or values.secret_key == 'dev-secret-key-change-me':
+            raise RuntimeError('LINKLOG_SECRET_KEY must be configured in production')
+        if len(values.secret_key) < 32 or len(set(values.secret_key)) < 12:
+            raise RuntimeError('LINKLOG_SECRET_KEY must be at least 32 characters with sufficient entropy')
+        if not values.data_encryption_key:
+            raise RuntimeError('LINKLOG_DATA_ENCRYPTION_KEY must be configured in production')
+
+    if values.data_encryption_key:
+        try:
+            Fernet(values.data_encryption_key.encode('ascii'))
+        except (ValueError, UnicodeEncodeError) as error:
+            raise RuntimeError('LINKLOG_DATA_ENCRYPTION_KEY must be a valid Fernet key') from error

backend/app/core/errors.py

@@ -0,0 +1,23 @@
+import re
+from uuid import uuid4
+
+from fastapi import Request
+
+
+SENSITIVE_PATTERN = re.compile(
+    r'(?i)(authorization\s*[:=]\s*bearer\s+[^\s,;]+|'
+    r'(?:token|password|secret|otp|code)(?:[_-](?:token|password|secret|code))?\s*[:=]\s*[^\s,;&]+|'
+    r'([?&](?:token|code|password|secret|otp)=[^&#\s]+))'
+)
+
+
+def request_id(request: Request) -> str:
+    return getattr(request.state, 'request_id', None) or str(uuid4())
+
+
+def redacted_error(error: Exception) -> str:
+    return SENSITIVE_PATTERN.sub('[REDACTED]', str(error))
+
+
+def public_error(request: Request, message: str) -> str:
+    return f'{message} Reference: {request_id(request)}'

backend/app/main.py

@@ -1,8 +1,9 @@
 ## Copyright © 2026 Olaf Kolkman
 ## SPDX-License-Identifier: GPL-3.0-or-later
 
-from fastapi import FastAPI
+from fastapi import FastAPI, Request
 import logging
+from uuid import uuid4
 from fastapi.responses import HTMLResponse
 from fastapi.responses import RedirectResponse
 from fastapi.staticfiles import StaticFiles
@@ -17,13 +18,23 @@ from backend.app.api.public import router as public_router
 from backend.app.api.setup import router as setup_router
 from backend.app.api.setup import has_administrator
 from backend.app.api.user_config import router as user_config_router
-from backend.app.core.config import settings
+from backend.app.core.config import settings, validate_configuration
 from backend.app.database import AVATARS_DIR
 from backend.app.services.link_service import get_public_profile, list_public_links
 
 logging.basicConfig(level=getattr(logging, settings.log_level, logging.INFO))
+validate_configuration(settings)
 
 app = FastAPI(title='LinkLog API', version=settings.version)
+
+
+@app.middleware('http')
+async def add_request_id(request: Request, call_next):
+    request.state.request_id = request.headers.get('X-Request-ID') or str(uuid4())
+    response = await call_next(request)
+    response.headers['X-Request-ID'] = request.state.request_id
+    return response
+
 app.mount('/static', StaticFiles(directory='frontend/static'), name='static')
 app.mount('/media', StaticFiles(directory=AVATARS_DIR), name='media')
 app.include_router(auth_router, prefix='/api/auth')
@@ -35,6 +46,7 @@ app.include_router(user_config_router, prefix='/api/user')
 app.include_router(setup_router, prefix='/api/setup')
 
 templates = Jinja2Templates(directory='frontend/templates')
+templates.env.globals['app_version'] = settings.version
 
 
 @app.get('/', response_class=HTMLResponse)

backend/app/services/plugin_manager.py

@@ -68,7 +68,9 @@ class MastodonPlugin(BasePlugin):
             post_prefix = f'#{str(config["hashtag"]).strip().lstrip("#")} '
         post_prefix = str(post_prefix if post_prefix is not None else DEFAULT_POST_PREFIX).strip()
         title = str(event.get('title') or '').strip()
-        status_parts = [f'{post_prefix} {title}'.strip()]
+        status_parts = [post_prefix.strip()]
+        if title:
+            status_parts.append(title)
         if event.get('comment'):
             status_parts.append(event['comment'])
         if title:

backend/tests/test_api.py

@@ -55,6 +55,17 @@ def test_login_returns_token():
     assert client.get('/api/auth/me', params={'token': payload['access_token']}).status_code == 401
 
 
+def test_logout_requires_bearer_header_and_revokes_token_family():
+    login = client.post('/api/auth/login', json={'email': 'alice@example.com', 'password': 'secret123'}).json()
+    token = login['access_token']
+    headers = {'Authorization': f'Bearer {token}'}
+    assert client.post('/api/auth/logout', json={'token': token}).status_code == 401
+    assert client.get('/api/auth/me', headers=headers).status_code == 200
+    assert client.post('/api/auth/logout', headers=headers).status_code == 200
+    assert client.get('/api/auth/me', headers=headers).status_code == 401
+    assert client.post('/api/auth/refresh', json={'refresh_token': login['refresh_token'], 'device_id': login['device_id']}).status_code == 401
+
+
 def test_login_rate_limit_locks_out_after_five_failures_and_resets_on_success():
     email = f'unknown-{uuid4().hex}@example.com'
     for attempt in range(5):
@@ -216,7 +227,31 @@ def test_admin_reports_smtp_validation_errors():
             'smtp_use_tls': False,
         })
     assert failed_validation.status_code == 503
-    assert 'connection refused' in failed_validation.json()['detail']
+    assert failed_validation.json()['detail'].startswith('SMTP validation failed. Reference: ')
+    assert 'connection refused' not in failed_validation.json()['detail']
+    assert failed_validation.headers['X-Request-ID']
+
+
+def test_request_id_is_preserved_and_sensitive_error_text_is_not_returned():
+    headers = login_headers()
+    with get_connection() as conn:
+        conn.execute('DELETE FROM app_settings WHERE name = ?', ('admin_smtp_mail_rate',))
+        conn.commit()
+    with patch('backend.app.api.admin.send_test_email', side_effect=RuntimeError('password=super-secret token=abc123')):
+        response = client.post(
+            '/api/admin/smtp/test',
+            headers={**headers, 'X-Request-ID': 'audit-test-123'},
+            json={
+                'smtp_host': 'smtp.example.com',
+                'smtp_port': 2525,
+                'smtp_from': 'admin@example.com',
+            },
+        )
+    assert response.status_code == 503
+    assert response.headers['X-Request-ID'] == 'audit-test-123'
+    assert response.json()['detail'] == 'SMTP validation failed. Reference: audit-test-123'
+    assert 'super-secret' not in response.text
+    assert 'abc123' not in response.text
 
 
 def test_admin_can_add_list_and_remove_users():
@@ -643,8 +678,7 @@ def test_only_link_owner_can_edit_link():
 
 def test_logout_revokes_token_and_admin_can_list_plugins():
     headers = login_headers()
-    token = headers['Authorization'].removeprefix('Bearer ')
-    assert client.post('/api/auth/logout', json={'token': token}).status_code == 200
+    assert client.post('/api/auth/logout', headers=headers).status_code == 200
 
     revoked_response = client.post('/api/links', headers=headers, json={
         'title': 'Should fail',
@@ -693,6 +727,8 @@ def test_public_and_admin_pages_render_html():
     about_page = client.get('/about')
     assert about_page.status_code == 200
     assert 'Save the good stuff' in about_page.text
+    assert '<h2>Plugin</h2>' in about_page.text
+    assert 'https://git.kolkman.org/olaf/Link-Log/raw/branch/main/XPI/signed/LinkLog-0.1.0.xpi' in about_page.text
     assert 'id="auth-about-link" href="/about"' in about_page.text
     assert client.get('/admin').status_code == 200
     admin_page = client.get('/admin').text
@@ -760,7 +796,7 @@ def test_link_submission_posts_to_enabled_mastodon_plugin():
         assert received['path'] == '/api/v1/statuses'
         assert received['authorization'] == 'Bearer test-token'
         assert received['content_type'] == 'application/x-www-form-urlencoded'
-        assert received['body'] == {'status': ['From my #LinkLog: A useful page\n\nWorth sharing\n\nfrom: https://example.com/useful\n\n#python #web']}
+        assert received['body'] == {'status': ['From my #LinkLog:\n\nA useful page\n\nWorth sharing\n\nfrom: https://example.com/useful\n\n#python #web']}
         posted_item = next(item for item in client.get('/api/public/feed/alice', headers=headers).json() if item['id'] == response.json()['id'])
         assert posted_item['mastodon_posted'] is True
     finally:

backend/tests/test_configuration.py

@@ -1,10 +1,36 @@
 import re
 from pathlib import Path
+import pytest
+
+from backend.app.core.config import Settings, validate_configuration
 
 
 ROOT = Path(__file__).resolve().parents[2]
 
 
+def test_production_configuration_rejects_missing_or_default_secret():
+    with pytest.raises(RuntimeError, match='LINKLOG_SECRET_KEY'):
+        validate_configuration(Settings(app_env='production', secret_key='', data_encryption_key=''))
+    with pytest.raises(RuntimeError, match='LINKLOG_SECRET_KEY'):
+        validate_configuration(Settings(app_env='production', secret_key='dev-secret-key-change-me', data_encryption_key=''))
+
+
+def test_production_configuration_rejects_weak_or_missing_encryption_key():
+    with pytest.raises(RuntimeError, match='entropy'):
+        validate_configuration(Settings(app_env='production', secret_key='A' * 32, data_encryption_key=''))
+    with pytest.raises(RuntimeError, match='DATA_ENCRYPTION_KEY'):
+        validate_configuration(Settings(app_env='production', secret_key='A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6', data_encryption_key='invalid'))
+
+
+def test_production_configuration_accepts_strong_secrets():
+    values = Settings(
+        app_env='production',
+        secret_key='A1b2C3d4E5f6G7h8I9j0K1l2M3n4O5p6',
+        data_encryption_key='L5M4sQYVjD1N7pT2Xk8R0aBcDeFgHiJkLmNoPqRsTuV=',
+    )
+    validate_configuration(values)
+
+
 def test_production_compose_configuration_matches_settings_environment_keys():
     compose = (ROOT / 'docker-compose.yml').read_text()
     settings = (ROOT / 'backend' / 'app' / 'core' / 'config.py').read_text()

backend/tests/test_user_config.py

@@ -51,6 +51,8 @@ def test_user_config_api_and_profile_page():
     assert 'id="auth-avatar"' not in page_response.text
     assert 'name="new_password_confirmation"' in page_response.text
     assert 'id="additional-email-form"' in page_response.text
+    assert 'If you have not downloaded the plugin yet' in page_response.text
+    assert 'https://git.kolkman.org/olaf/Link-Log/raw/branch/main/XPI/signed/LinkLog-0.1.0.xpi' in page_response.text
 
     bob_login = client.post('/api/auth/login', json={
             'email': 'bob@example.com',

frontend/static/logout.js

@@ -12,8 +12,7 @@ logoutButton.addEventListener('click', async () => {
   if (token) {
     await fetch('/api/auth/logout', {
       method: 'POST',
-      headers: {'Content-Type': 'application/json'},
-      body: JSON.stringify({token}),
+      headers: {Authorization: `Bearer ${token}`},
     }).catch(() => undefined);
   }
 

frontend/templates/about.html

@@ -52,8 +52,14 @@
             <p>LinkLog is open source software. You can run your own instance, or contribute to the project on 
                 <a href="https://git.kolkman.org/olaf/Link-Log">my repository</a>.</p>
         </section>
+        <section class="link-item">
+          <h2>Plugin</h2>
+          <p>Install the Firefox plugin to save links directly from your browser. <a
+            href="https://git.kolkman.org/olaf/Link-Log/raw/branch/main/XPI/signed/LinkLog-0.1.0.xpi"
+            download>Download and install the Plugin</a>.</p>
+        </section>
     </main>
-    <footer class="site-footer">Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
+    <footer class="site-footer">LinkLog Version {{ app_version }}. Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
     <script src="/static/auth-header.js?v=3"></script>
     <script src="/static/logout.js?v=3"></script>
     <script src="/static/theme.js?v=1"></script>

frontend/templates/admin.html

@@ -115,7 +115,7 @@
       </section>
       </div>
     </main>
-    <footer class="site-footer">Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
+    <footer class="site-footer">LinkLog Version {{ app_version }}. Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
     <script src="/static/auth-header.js?v=3"></script>
     <script src="/static/logout.js?v=2"></script>
     <script src="/static/theme.js?v=1"></script>

frontend/templates/feed.html

@@ -76,7 +76,7 @@
       {% endif %}
       <section id="feed" class="feed" aria-live="polite"></section>
     </main>
-    <footer class="site-footer">Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
+    <footer class="site-footer">LinkLog Version {{ app_version }}. Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
 
     <script src="/static/auth-header.js?v=3"></script>
     <script src="/static/logout.js?v=3"></script>

frontend/templates/labels.html

@@ -44,7 +44,7 @@
         <div id="label-list" class="plugin-list"></div>
       </section>
     </main>
-    <footer class="site-footer">Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
+    <footer class="site-footer">LinkLog Version {{ app_version }}. Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
     <script src="/static/auth-header.js?v=3"></script>
     <script src="/static/logout.js?v=3"></script>
     <script src="/static/theme.js?v=1"></script>

frontend/templates/login.html

@@ -55,7 +55,7 @@
         </form>
       </section>
     </main>
-    <footer class="site-footer">Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
+    <footer class="site-footer">LinkLog Version {{ app_version }}. Copyright © 2026 Olaf Kolkman  · <a href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
     <script src="/static/auth-header.js?v=3"></script>
     <script src="/static/logout.js?v=3"></script>
     <script src="/static/theme.js?v=1"></script>

frontend/templates/setup.html

@@ -42,7 +42,7 @@
         </form>
       </section>
     </main>
-    <footer class="site-footer">Copyright © 2026 Olaf Kolkman</footer>
+    <footer class="site-footer">LinkLog Version {{ app_version }}. Copyright © 2026 Olaf Kolkman</footer>
     <script src="/static/theme.js?v=1"></script>
     <script src="/static/setup.js"></script>
   </body>

frontend/templates/user_profile.html

@@ -59,6 +59,7 @@
         </label>
         <img id="avatar-preview" class="profile-avatar-preview hidden" alt="Avatar preview" />
         <button type="submit">Save profile</button>
+        <p>If you have not downloaded the plugin yet, <a href="https://git.kolkman.org/olaf/Link-Log/raw/branch/main/XPI/signed/LinkLog-0.1.0.xpi" download>find it here</a>.</p>
         <p id="profile-status" class="status" role="status"></p>
       </form>
     </section>
@@ -144,7 +145,7 @@
       </form>
     </section>
   </main>
-  <footer class="site-footer">Copyright © 2026 Olaf Kolkman · <a
+  <footer class="site-footer">LinkLog Version {{ app_version }}. Copyright © 2026 Olaf Kolkman · <a
       href="https://git.kolkman.org/olaf/Link-Log">git.kolkman.org/LinkLog</a></footer>
   <script src="/static/auth-header.js?v=3"></script>
   <script src="/static/logout.js?v=2"></script>

scripts/release/validate_release.py

@@ -9,61 +9,66 @@ from pathlib import Path
 
 
 ROOT = Path(__file__).resolve().parents[2]
-MANIFEST_PATH = ROOT / 'webextension' / 'manifest.json'
-FRONTEND_VERSION_PATH = ROOT / 'frontend' / 'version.json'
 SETTINGS_PATH = ROOT / 'backend' / 'app' / 'core' / 'config.py'
-UPDATES_PATH = ROOT / 'webextension' / 'updates.json'
 SIGNED_DIR = ROOT / 'XPI' / 'signed'
+VERSION_RE = re.compile(r'\d+\.\d+\.\d+')
 
 
 def fail(message: str) -> None:
     raise SystemExit(f'release validation failed: {message}')
 
 
+def version_key(version: str) -> tuple[int, int, int]:
+    return tuple(int(part) for part in version.split('.'))
+
+
+def find_latest_signed_xpi() -> tuple[str, Path]:
+    candidates = []
+    for xpi_path in SIGNED_DIR.glob('LinkLog-*.xpi'):
+        match = re.fullmatch(r'LinkLog-(\d+\.\d+\.\d+)\.xpi', xpi_path.name)
+        if match:
+            candidates.append((match.group(1), xpi_path))
+    if not candidates:
+        fail(f'no signed plugin artifacts found in {SIGNED_DIR.relative_to(ROOT)}')
+    return max(candidates, key=lambda candidate: version_key(candidate[0]))
+
+
 def main() -> None:
-    manifest = json.loads(MANIFEST_PATH.read_text())
-    extension_version = manifest.get('version')
-    if not isinstance(extension_version, str) or not re.fullmatch(r'\d+\.\d+\.\d+', extension_version):
-        fail('webextension/manifest.json has no valid three-part version')
-
-    frontend_version = json.loads(FRONTEND_VERSION_PATH.read_text()).get('version')
-    if frontend_version != extension_version:
-        fail(f'frontend version {frontend_version} does not match extension version {extension_version}')
-
-    gecko_settings = manifest.get('browser_specific_settings', {}).get('gecko', {})
-    data_permissions = gecko_settings.get('data_collection_permissions')
-    if data_permissions != {'required': ['websiteActivity'], 'optional': []}:
-        fail('Firefox data_collection_permissions must require websiteActivity and have no optional categories')
-
     settings = SETTINGS_PATH.read_text()
     match = re.search(r"version: str = os\.getenv\('LINKLOG_VERSION', '([^']+)'\)", settings)
     if not match:
         fail('backend version default could not be found')
     backend_version = match.group(1)
-    if backend_version != extension_version:
-        fail(f'backend version {backend_version} does not match extension version {extension_version}')
+    if not VERSION_RE.fullmatch(backend_version):
+        fail(f'backend version {backend_version} is not a valid three-part version')
 
-    xpi_path = SIGNED_DIR / f'LinkLog-{extension_version}.xpi'
-    if not xpi_path.is_file():
-        fail(f'missing manually signed artifact: {xpi_path.relative_to(ROOT)}')
+    extension_version, xpi_path = find_latest_signed_xpi()
     with zipfile.ZipFile(xpi_path) as archive:
         try:
             packaged_manifest = json.loads(archive.read('manifest.json'))
         except KeyError:
             fail('signed XPI does not contain manifest.json')
         if packaged_manifest.get('version') != extension_version:
-            fail('signed XPI manifest version does not match webextension/manifest.json')
+            fail('signed XPI manifest version does not match its filename')
+        gecko_settings = packaged_manifest.get('browser_specific_settings', {}).get('gecko', {})
+        data_permissions = gecko_settings.get('data_collection_permissions')
+        if data_permissions != {'required': ['websiteActivity'], 'optional': []}:
+            fail('Firefox data_collection_permissions must require websiteActivity and have no optional categories')
         if archive.testzip() is not None:
             fail('signed XPI contains a corrupt member')
 
-    updates = json.loads(UPDATES_PATH.read_text())
-    addon_id = gecko_settings['id']
-    update_entries = updates.get('addons', {}).get(addon_id, {}).get('updates', [])
-    if not any(entry.get('version') == extension_version for entry in update_entries):
-        fail(f'webextension/updates.json has no update entry for {extension_version}')
+    signed_xpi = xpi_path.relative_to(ROOT)
+    if len(sys.argv) == 3 and sys.argv[1] == '--github-output':
+        with Path(sys.argv[2]).open('a') as output:
+            print(f'backend_version={backend_version}', file=output)
+            print(f'plugin_version={extension_version}', file=output)
+            print(f'signed_xpi={signed_xpi}', file=output)
+    elif len(sys.argv) != 1:
+        fail('usage: validate_release.py [--github-output <path>]')
 
-    print(f'validated LinkLog release {frontend_version}')
-    print(f'xpi={xpi_path.relative_to(ROOT)}')
+    print(f'validated LinkLog backend release {backend_version}')
+    print(f'plugin_version={extension_version}')
+    print(f'signed_xpi={signed_xpi}')
 
 
 if __name__ == '__main__':

webextension/manifest.json

@@ -30,7 +30,7 @@
   "browser_specific_settings": {
       "gecko": {
         "id": "linklog@kolkman.org",
-        "strict_min_version": "112.0",
+        "strict_min_version": "142.0",
         "data_collection_permissions": {
           "required": ["websiteActivity"],
           "optional": []

webextension/options.js

@@ -186,8 +186,7 @@ async function signOut() {
   if (sessionSettings.accessToken && settings.backendUrl && await hasBackendPermission(backendUrl)) {
     await fetch(`${backendUrl}/api/auth/logout`, {
       method: 'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ token: sessionSettings.accessToken }),
+      headers: {Authorization: `Bearer ${sessionSettings.accessToken}`},
     }).catch(() => undefined);
   }
   await clearSession();