- Remove Google Fonts links from web dashboard and testpage: opening
the page no longer sends requests (IP/UA) to Google; system font
stack renders identically, works offline and loads faster in CN
- Override default python-httpx User-Agent with a browser UA on all
Xiaomi requests (matches cookie-based login origin, removes script
fingerprint)
- PRIVACY.md: document zero-CDN frontend and minimal outbound headers
- CORS: default localhost-only origins (was *, allowed any webpage
to read local health data cross-site); env override MI_FITNESS_CORS_ORIGINS
- Host header allowlist middleware on FastAPI and Flask (DNS-rebinding
protection); auto-configured for non-loopback binds via CLI
- Move API key passTokens from SQLite plaintext to system keyring,
with automatic migration on startup and cleanup for revoked keys
- Disable uvicorn access log by default (query params out of terminals)
- New GET /api/export: JSON/CSV export of local data (offline, Excel BOM)
- Add docs/PRIVACY.md: full data-flow audit, outbound endpoint inventory,
threat model, self-verification steps
- 6 new tests (host allowlist, keyring roundtrip, CSV)
Package the standalone Mi Fitness MCP with clearer public docs, release metadata, CI, and safer local repository hygiene so it is ready to publish without secrets or work identity leakage.
binglua