Tags: envx-cn/corx

v0.2.0 — per-key scope, cache purge, stale-if-error, edge rate limiti…

…ng, observability

A feature release. New isolation controls for keys (method / path / CIDR /
expiry scope), operator control over the cache (purge on demand, stale-if-error),
a cheaper opt-in rate limiter, real cache-hit semantics, streamed uploads, and
the measurement surface to tell whether any of it pays for itself.

Three additive migrations (0013-0015). One behaviour change: /health?deep=1
now answers 401 without an admin credential.

Reviewed before tagging; see PR #132.

v0.1.1 — security & correctness hardening

- Path-mode targets keep their query string (minus corx-* control params)
- Proxied HTML served with Content-Security-Policy: sandbox
- Redirects always manual: blocklist/DNS re-checked per hop, credentials dropped cross-origin
- rate_limit_per_min validated server-side
- Blocklist entries validated; constant-time ADMIN_TOKEN comparison
- X-Api-Key shape-aware: BYOK rides through, corx-shaped values never forwarded
- Console footer shows the app version (build-time define)
- 610 tests, docs synced (README/FEATURES/SECURITY, /docs en+zh)

CORX v0.1.0 — first release: one Cloudflare Worker (HonoX + D1 + R2) …

…you deploy yourself, with the console, upstream secret injection and docs around it.