- Remove Google Fonts links from web dashboard and testpage: opening
the page no longer sends requests (IP/UA) to Google; system font
stack renders identically, works offline and loads faster in CN
- Override default python-httpx User-Agent with a browser UA on all
Xiaomi requests (matches cookie-based login origin, removes script
fingerprint)
- PRIVACY.md: document zero-CDN frontend and minimal outbound headers
- CORS: default localhost-only origins (was *, allowed any webpage
to read local health data cross-site); env override MI_FITNESS_CORS_ORIGINS
- Host header allowlist middleware on FastAPI and Flask (DNS-rebinding
protection); auto-configured for non-loopback binds via CLI
- Move API key passTokens from SQLite plaintext to system keyring,
with automatic migration on startup and cleanup for revoked keys
- Disable uvicorn access log by default (query params out of terminals)
- New GET /api/export: JSON/CSV export of local data (offline, Excel BOM)
- Add docs/PRIVACY.md: full data-flow audit, outbound endpoint inventory,
threat model, self-verification steps
- 6 new tests (host allowlist, keyring roundtrip, CSV)
binglua