9 July 2026v0.7.22
Security review readiness and export safeguards
Strengthens export, public display, import, and deployment safeguards ahead of the next production checkpoint.
Changes & improvements
- Tightened customer, deal, saved-report, and finance exports so downloads consistently respect explicit export permissions and dealership scope.
- Hardened Leaderboard TV display links with hashed credentials, rotation metadata, expiry, and revocation handling.
- Added safer source-review and deployment documentation, including sanitized environment examples and clearer database security notes.
- Strengthened preview and production deployment defaults so protected routes fail closed when required Supabase auth configuration is missing.
Bug fixes
- Restricted AI-assisted import helpers to users with bulk-import permission before provider calls or candidate matching.
- Bound board attachment signing to the upload owner or legacy author record.
- Added shared spreadsheet-size limits for client-side import flows and server-side import handling.
- Sanitized generated markdown links across browser and PDF rendering surfaces.
- Removed obsolete diagnostics and placeholder mobile app links from production-facing surfaces.