Internal
Public Access
Keith SmithandClaude Sonnet 5
f41939983a
README.md: backfill the Changelog with the 2026.9.5, 2026.8.31.1, 2026.8.31, and v1.2.0 releases that were missing (it jumped straight from 1.0.0 to 1.1.0). Also correct the stale "Mobile App Support"/"Mobile App Integration" sections - the native Android app is retired, and the sync protocol they describe now powers the offline PWA instead. Remove Firebug IT branding/contact info across README.md, API.md, and the site footer, and drop the stale tasks.firebugit.com fallback from development.py's ALLOWED_HOSTS/CSRF_TRUSTED_ORIGINS. AllowMobileAppFramingMiddleware detected the native app via a 'com.firebugit.keepitgoing' User-Agent check to allow WebView iframe embedding. With that app retired, replaced it with SecurityHeadersMiddleware, which applies the same X-Frame-Options/CSP headers unconditionally instead of only for non-mobile requests - same protection for real users, dead branch and dead branding gone. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>