v0.21.0 — Security: DNS-rebinding protection + optional API key

Security

• DNS-rebinding protection is now enabled by default on the local HTTP transport (GHSA-j9xx-59ph-wmr6). The server validates the Host and Origin of every request against a loopback allowlist (127.0.0.1, localhost, [::1]). A forged Host is rejected with 421, a forged Origin with 403. This closes a vector where a malicious web page could DNS-rebind to your local server and invoke tools. The tunnel (WebSocket) transport is unaffected.

Added

• http_allowed_hosts / http_allowed_origins — extend the allowlist to expose the HTTP server through a tunnel or reverse proxy, instead of disabling protection. Host entries are scheme-less (myapp.ngrok.io); origin entries include the scheme (https://myapp.example).
• http_api_key — optional shared-secret auth (AnkiConnect-style). When set, every HTTP request must send Authorization: Bearer <key> (constant-time compared); failures return 403. Empty by default (disabled).

Backward compatibility

• Local-only use is unaffected. If you reached the HTTP server under a non-loopback name (bound to 0.0.0.0, or behind ngrok / Cloudflare / a reverse proxy), those requests now return 421 Invalid Host header until you add the host to http_allowed_hosts (and the origin to http_allowed_origins for browser clients), or run ngrok http --host-header=rewrite 3141.

Thanks to @avishaigo-commits for the responsible disclosure.