{
  "summary": "API keys, including the bootstrap superadmin key, were generated from a predictable clock-derived source rather than a cryptographic one; new keys now use a cryptographically secure generator, and keys created before this release should be rotated. Two threat detections that had silently never fired now work: the DGA check skipped exactly the uncategorized domains it exists to catch, and credential-submission checks never recognized lookalikes of VRM-approved login hosts. The ASHFP1 client fingerprint is redesigned as a readable value that classifies the client from its HTTP headers, records its TLS fingerprint and the operating system its TCP connection comes from, and checks all three against what the client claims in its User-Agent - a script that imitates a browser's User-Agent without its headers, TLS stack or operating system is flagged (ua-hdr, ua-tls, ua-os), and connections from raw-socket tools are marked raw. Existing ASHFP1 values no longer match; the server log and the rule editor flag rules that still use them. Flood protection is hardened: the global per-fingerprint limit now only counts requests the per-source limit let through, so a single source imitating a common client can no longer lock out everyone sharing that fingerprint, and over-limit requests to the agent API over HTTP/2 are now held and dropped silently instead of receiving an immediate error; with the headerless flood limits enabled, the proxy listener no longer accepts MPTCP. Starting the server without -f (background mode) never actually started it; it now does, validates the configuration before detaching, writes its output to server.log in the data directory, and reports a failed startup in the terminal. The controller's internals were reorganized into smaller modules with added test coverage, with no change in behavior."
}