binglua a47a8470f8 feat(security): privacy hardening + data export (v0.2.1) ...

- CORS: default localhost-only origins (was *, allowed any webpage
  to read local health data cross-site); env override MI_FITNESS_CORS_ORIGINS
- Host header allowlist middleware on FastAPI and Flask (DNS-rebinding
  protection); auto-configured for non-loopback binds via CLI
- Move API key passTokens from SQLite plaintext to system keyring,
  with automatic migration on startup and cleanup for revoked keys
- Disable uvicorn access log by default (query params out of terminals)
- New GET /api/export: JSON/CSV export of local data (offline, Excel BOM)
- Add docs/PRIVACY.md: full data-flow audit, outbound endpoint inventory,
  threat model, self-verification steps
- 6 new tests (host allowlist, keyring roundtrip, CSV)

2026-09-03 22:43:15 +08:00

..

test_config.py

feat: prepare mi-fitness-mcp for first public release

2026-03-12 14:12:49 +03:00

test_mi_fitness_cloud.py

feat: improve cloud sync reliability and background status

2026-07-13 04:03:57 +00:00

test_security.py

feat(security): privacy hardening + data export (v0.2.1)

2026-09-03 22:43:15 +08:00

test_server_sync.py

feat: improve cloud sync reliability and background status

2026-07-13 04:03:57 +00:00

test_storage_query.py

feat: prepare mi-fitness-mcp for first public release

2026-03-12 14:12:49 +03:00

test_sync_service.py

feat: improve cloud sync reliability and background status

2026-07-13 04:03:57 +00:00

test_web.py

feat: REST API with API keys, QR login, and web dashboard (v0.2.0)

2026-09-03 22:28:31 +08:00