4.6 Change Log

Security fixes

• "Fill from link" on the submit form had a server-side request forgery hole. Our server would fetch whatever address you pasted, including addresses that only make sense inside our own hosting network. It now refuses private and internal addresses and checks every redirect along the way. Normal links to Instagram posts and event pages work the same as before.
• Next.js, Better Auth, Capacitor, MapLibre, and sanitize-html all had published security fixes we hadn't picked up yet. The worst were in Next.js, which powers the whole site. All of them are upgraded. The Capacitor fix lives inside the iOS app itself, so it rides along with the next App Store update. Everything else here is on the server and already live, no update needed.
• Looking up a submission's status by contact handle is now rate-limited, so nobody can rapidly guess handles to see who submitted what.

Privacy fixes

• We stopped storing your IP address with meet submissions. The Privacy Policy already said your IP was only a short-lived rate-limit key and never saved with the submission. That wasn't true: every submission since April 30 kept it. Rate limiting now works the way the policy described, and the IPs saved with past submissions are deleted. They were never shown anywhere in the app or shared with anyone.
• Data tied to an install now expires. If you clear the app's storage or reinstall, the saved meets, preferences, push token, and alert rows tied to your old install used to stay on our server forever. Now anything tied to an install that hasn't synced or checked in for push in 12 months is deleted automatically. Inbox rows still go after 90 days.

Transparency reports

Monthly reports were too much for a one-person project, and four of the six went out late. Starting now they come out every six months. The six monthly reports are replaced by one March to November 2026 Transparency Report that covers everything since the first commit, including what this audit turned up. If you ever want a report for a specific month or period, ask me and I'll put one together.

Privacy policy and terms

Both changed, effective November 1.

The Privacy Policy now covers three things the app was already doing without saying so: flyer uploads on the submit form go through our server to Catbox, the search bar sends what you type to our server (we don't store it), and Cloudflare handles DNS for the site. Section 12 now explains how long submissions and install data are kept and how to ask us to delete them sooner. You can send your sync ID from Menu and we'll wipe everything tied to it.

The Terms change one line: the upload rules now cover flyer uploads as well as cover images.

What's new (but you'll never see it)

Server-side fetches of links people paste now go through one shared guard that resolves the address first and rejects anything private. Submission rate limiting moved off the submissions table onto the same short-lived buckets the rest of the site uses, and migration 0035 drops the old IP column. The nightly cleanup job gained the 12-month install expiry, with a test that makes sure installs still active on either sync or push are left alone.

Detroit Meets on the App Store · @alex.30mm on Instagram