# Secured Release Notes

**Version:** 1.9.1

This package is the secured development/production candidate derived from the purchased source. The original archive remains the rollback baseline.

## Main changes

- Stronger session invalidation after password changes.
- Hashed email/password-reset tokens.
- Hashed REST API keys with legacy migration.
- API query-token authentication disabled by default.
- Encrypted-at-rest webhook secrets for newly generated secrets.
- Additive webhook signature V2 with timestamp binding.
- Shared SSRF-safe outbound HTTP transport.
- Customer message/reply content removed from normal AI logs.
- Browser security headers.
- Production preflight and production build scripts.
- Production installation and rollback documentation.
- Separate license architecture review.

## Before production

1. Keep the original purchased archive untouched.
2. Back up the database, `.env`, WhatsApp session data and uploaded media according to your backup policy.
3. Install Node 22.12+ and the exact Go version declared in `go.mod` (currently Go 1.25.8).
4. Run `npm run setup`.
5. Run `npm run setup:env` only for a clean installation.
6. Configure `.env` and HTTPS/CORS.
7. Run `npm run preflight:production`.
8. Run `npm --prefix frontend ci && npm --prefix frontend run build`.
9. Run `go test ./backend/...`, `go vet ./backend/...`, and `govulncheck ./...`.
10. Run `npm run build:production`.
11. Start against staging first.
12. Verify login, WhatsApp connect/reconnect, API key, media, webhook, AI, scheduler, broadcast, backup/recovery and logout flows.
13. Only then switch production traffic.