Welcome to Speakr¶

Version 0.9.0-alpha - Multi-platform recording, Stats tab, mobile rebuild, design-system unification

The first non-patch release in the v0.8 line. Three big user-facing themes: capturing audio is now multi-platform, the mobile app is a first-class member of the design system, and the upload modal stops feeling like a desktop card pasted onto a phone. Backwards compatible with v0.8.x; database migrations run automatically.

• System Audio & Multi-Input Recording - Platform detection with a per-OS help guide (macOS BlackHole + Multi-Output Device, Windows "Share system audio", Linux pavucontrol + pactl module-virtual-source). New Input devices picker mixes a primary mic plus an optional secondary device via Web Audio into one track, with a toggle to disable Chrome's echo cancellation / noise suppression / auto-gain and virtual-audio-device discovery.
• Stats Tab - New per-recording tab: total length, speaker count, turns, and words as headline cards; per-speaker time / % / turns / words / WPM breakdown; silence row. Available on desktop and mobile.
• Upload Modal Redesign - Real modal overlay (not a full-screen takeover), progressive disclosure of Options behind a chip summary, inline file preview with duration probe, sticky-footer Upload action, last-used tag / folder / language auto-restore, and a mobile bottom-sheet with drag-to-dismiss.
• Mobile UI Rebuild - 56 px bottom navigation, contextual icons in the chevron row, edge-to-edge content, sticky speaker pills, sticky editor Cancel / Save footer, and audio-player polish.
• PWA Web Share Target - Pick Speakr from your phone's native share sheet to send a recording straight in.
• Webhooks - HMAC-SHA256-signed outbound notifications on recording lifecycle events, with SSRF guard and exponential-backoff retries, managed per-user from Account settings → Webhooks.
• Server-side recording sessions - Long recordings stream chunks to the server during capture; the size cap is replaced by a configurable hours-based ceiling with resume-on-reload.
• Design-system unification - 22 modals on shared .modal-* primitives, .btn + .field everywhere, dark-mode <select> theming, header consolidation, sidebar redesign, floating dockable chat panel.
• Inquire mode - "+ New Recording" opens the upload modal directly via ?upload=1. Also: GET /api/v1/users/me, an audio-player position preference, and a localization refresh across all seven languages.

See the full release notes for the complete list.

Version 0.8.21-alpha - Security: CSRF bypass and SSO account takeover

Security patch release on top of v0.8.20-alpha. Tracked as a GitHub Security Advisory; reported by @Irench1k.

• Fixed a CSRF bypass where the csrf_exempt_for_api_tokens before_request hook permanently disabled CSRF protection on the targeted view as soon as any request carried a ?token= query parameter (CWE-287). The hook is gone; CSRF skipping is now a per-request decision driven by load_user_from_token_headers_only().
• change_password no longer silently sets a password on an SSO-only account, closing the chained account-takeover path.