v12.3.6

CapSoftware/Capv12.3.6Apr 20, 2026by thedotmack

AI Summary

A viewer fix release that removes the rate limiter which was blocking the live viewer due to excessive polling. The release retains other security hardening measures.

Key Highlights

Removed rate limiter to fix live viewer polling
Retained 5 MB JSON body limit
Retained path traversal protection
Retained localhost-only CORS restrictions

Full Release Notes

## Viewer fix: drop the rate limiter

v12.3.5 kept the 300 req/min rate limiter from v12.3.3's "security hardening" bundle. That tripped the live viewer within seconds (it polls logs and stats) and served it "Rate limit exceeded" errors.

**Fix**: remove the rate limiter entirely. The worker is localhost-only (enforced via CORS), so there's no abuse surface to protect. Rate-limiting a single-user local process is security theater.

### Still kept from v12.3.3 hardening
- 5 MB JSON body limit
- Path traversal protection
- Localhost-only CORS
- Everything else from v12.3.5

No upgrade action required.