Changelog

🔐 Security & Privacy

• PIN-locked edit mode — set a 4-6 digit PIN to prevent unauthorized editing (SHA-256 hashed, server-side only)
• Server-side secrets store — API keys, calendar URLs, and tokens stored securely, never sent to browser
• Public Mode — hides edit button and blocks config APIs; subtle 🔒 unlock button for admin access
• Privacy warnings on sensitive widgets (System Log, Activity List, Cron Jobs, Calendar, Todo List)
• Template export now strips private calendar URLs with auth tokens
• Pre-commit hook blocks private data in template files

👥 Community

• Community Widgets — contribution guide, widget templates, and PR checklist for submissions

🐛 Fixes

• Removed private calendar URL accidentally included in template config
• Fixed template export sanitization for URLs with embedded auth tokens

🐛 Fixes

• Minor bug fixes and stability improvements

✨ New Features

• Template Gallery — export, import, and share dashboard layouts with auto-screenshot previews
• Notes widget — persistent rich-text notes with auto-save
• GitHub Stats widget — profile contributions, stars, and activity
• LobsterBoard Release widget — version update checker
• SSE streaming for real-time system stats
• Directory browser for image widgets
• Scrollable canvas mode
• html2canvas dashboard screenshot export
• Widget count: 47 → 50

🔄 Changed

• License changed from MIT to BSL-1.1
• Stock Ticker widget — fixed hasApiKey check
• Builder — contenteditable keyboard fix, null-checks throughout

🚀 Initial npm Release

• 47 widgets, drag-and-drop editor, custom pages system
• SSRF protection for proxy endpoints