- match subscription links by protocol instead of index (fixes trojan/mixed inbounds, e.g. Poland)
- support hysteria panels in create/delete client, skip in shortid rotation
- fix link regex to match hysteria2:// scheme
- reduce links cache TTL from 7 days to 1 hour (stale cache hid servers)
- delete client: fallback to id when uuid missing
- feat(web): telegram contact button on home page
- Server health ping every 30s — dead servers excluded from all API calls, auto-recovered when back online
- Fixed py3xui client.delete() argument order (inbound_id first, client_uuid second)
- Rate limiting on /admin/login (max 10 attempts per 60s per IP)
- XSS prevention: HTML-escape all user-controlled fields in templates
- CSP headers on all HTML pages (CSP, X-Frame-Options, X-Content-Type-Options)
- CORS restricted to configured host instead of wildcard
- Secure + SameSite=Lax cookie flags for admin_token
- Bind to 127.0.0.1 instead of 0.0.0.0
- Async locks for global state (last_donation_id)
- Graceful shutdown: all background tasks cancelled on exit
- DA polling exponential backoff: 1s→max 1h, immediate 1h on 401
SashegDev