Changelog

The examples on the home page are calm and real: no badge, no stamps and no drawn fake screens, just one heading, one sentence and one button each. The installer clones the v3.1.3 tag. The full list is in CHANGELOG.md.

The public transparency log tells the truth about itself: the mirror of other relays only holds tree heads from pinned keys, the 39 entries from April 2026 get their proof and tree hash from the current tree, and a customer can check a receipt himself. The installer clones the v3.1.2 tag. The full list is in CHANGELOG.md.

Repair round after 3.1.0: what a buyer reads around paying matches what he gets, the deploy checks the host hardening /dpa promises, and the installer clones the v3.1.1 tag. The full list is in CHANGELOG.md.

ParaSign as a product, security findings fixed and payment through Mollie. The full list is in CHANGELOG.md.

Security

• API keys arrive through a one-time claim link instead of in plain text in an email
• The public transparency log no longer publishes device identifiers
• Signing asks for a fresh step-up confirmation, and notary signatures are domain-separated (v2); old v1 proofs stay verifiable
• script-src 'unsafe-inline' is gone from the admin panel and the public site

Added

• ParaSign: signing in the browser at /en/sign, the PDF editor, multi-party signing and the /v1 developer API
• Signing in and signing with a passkey
• The public status page at /en/status
• A product check that sends a real file through the real relay every hour

Changed

• The relay is called source-available (BUSL-1.1), not open source
• The navigation names what we sell: seven items instead of forty

Removed

• The Android app, ParamantOS and ParaID

One version number for the whole project, and the post-quantum building blocks in their own library.

Changed

• ML-KEM-768 runs on the Rust library @paramant/core instead of @noble/post-quantum; wire format and client behaviour are unchanged
• One version everywhere: package.json, /health, the site and the installer say 3.0.0

Fixed

• Signing in after a key is created works again; users.json is written atomically

Admin panel hardening + email overhaul + TOTP security sprint.

Added

• Enterprise email templates: centralized admin/lib/email-templates.js with 5 dual-body (plain-text + HTML) transactional emails. Brand-consistent Paramant design. Preheader text, masked IP footer, List-Unsubscribe header, reply-to.
• Force TOTP per user: admin can require TOTP setup before next login; active sessions revoked immediately on enable
• Two-stage TOTP reset: request email → confirmation email (1h TTL) → TOTP cleared only after confirmation link clicked
• Email enumeration protection on /api/user/auth/request-totp-reset (always returns 200)
• Rich per-user email action menu with preview-before-send
• Server-side pagination on Users list (page, page_size, status, plan filters)
• Audit logging on all mutating admin endpoints
• Global audit ZSET for O(log n) recent-events queries
• email + created fields on user records (new + backfilled)
• API key masking in users list (first 8 + last 4 chars)
• Clean JSON error responses: no HTML stack traces
• WCAG AA on admin panel (ARIA, keyboard nav, skip link, focus indicators)
• Admin panel documentation (admin/ADMIN.md)

Changed

• From-address on all transactional emails: noreply@ → hello@paramant.app
• TOTP reset confirmation TTL: 15 min → 60 min
• delete_account admin rate limit: 3/day → 50/day

Fixed

• Admin panel showing — instead of 0 for empty stat cards
• Relay dashboard showing 0h uptime
• Delete-account causing "Error loading users" on next refresh
• Missing ADMIN_TOKEN headers on internal callRelay() calls (all returning 401)
• Modal element IDs not matching JS function references

Security

• TOTP reset requires inbox access: attacker with known email cannot force a reset
• Rate limits on reset flow: 5/email/24h + 10/IP/1h
• Error responses are JSON only: no internal paths or server info leaked
• 24/24 integration tests passing

Enterprise readiness sprint. Admin panel redesign + security audit.

Added

• Five-tab admin dashboard (Overview, Users, Audit, Billing, Relay): v4 Denim Edit styling
• User signup flow at /signup with TOTP enrollment (no password)
• Billing scaffold with Mollie placeholder: checkout, cancel, status, history
• Chromium browser extension (dual-mode: API key + TOTP)
• Wazuh SIEM agent connected via Tailscale
• Security audit carried out: 6-layer scope, low risk (0 critical, 0 high)

Changed

• GitHub Actions pinned to commit SHAs for supply-chain security
• TOTP v2 rolled out to beta users; Q2 2026 banners removed
• Setup flow now waits for a button press, so email scanners cannot use up the setup token
• POST /api/user/auth/setup/:token idempotent for provisional enrollments
• @noble/post-quantum updated to 0.6.1

Fixed

• Setup token consumed by email scanners (Gmail, Barracuda, Proofpoint)
• INTERNAL_AUTH_TOKEN missing from admin container: relay calls returning 401
• Wazuh agent connectivity after UFW default-deny reboot

Security

• Setup tokens no longer consumed by email preview scanners
• Full 6-layer automated audit completed; all findings fixed same session
• Load tested to 500 req/s: p95 135ms, zero errors