Starstruk Logo MarkStarstruk

v0.0.3

CoreBunch/Instaticv0.0.3Jun 10, 2026by github-actions[bot]

AI Summary

This release prioritizes plugin security and sandbox hardening. It introduces encryption for plugin secrets at rest and adds an escape hatch for force-uninstalling plugins.

Key Highlights

  • Harden plugin sandbox against hangs and preserve VM stack traces
  • Encrypt plugin secret settings at rest in a dedicated table
  • Add force-uninstall escape hatch
  • Mask secret plugin settings on client-facing payloads

New Features

  • Encrypted plugin secrets at rest
  • Force-uninstall escape hatch for plugins

Full Release Notes

## What's Changed
* [codex] Update toolbar site branding by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/8
* Harden plugin sandbox against hangs and preserve VM stack traces by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/4
* Make plugin fetch and HTTP routes binary-safe by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/5
* Push admin settings changes to running plugin VMs by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/2
* Namespace plugin-emitted hook events to plugin.<id>.* by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/6
* Fix plugin scheduler: cancel namespacing, pause persistence, disabled-plugin fires, ghost sweep by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/3
* Mask secret plugin settings on every client-facing payload by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/7
* Encrypt plugin secret settings at rest in a dedicated plugin_secrets table by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/12
* Add force-uninstall escape hatch and run deactivate before uninstall by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/9
* Require editor.code permission for unsandboxed admin-window plugin code by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/10
* [codex] Fix data table step-up flow by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/11
* docs(deployment): TRUSTED_PROXY_CIDRS and Railway/Render template hardening by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/13
* Decouple CSRF origin from proxy trust via PUBLIC_ORIGIN; drop 0.0.0.0/0 from templates by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/14
* Revamp README: screenshots, one-click Railway deploy, real voice by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/16
* Prepare v0.0.3 release by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/17
* Stabilize flaky plugin sandbox infinite-loop abort test by @DavidBabinec in https://github.com/CoreBunch/Instatic/pull/18

## New Contributors
* @DavidBabinec made their first contribution in https://github.com/CoreBunch/Instatic/pull/8

**Full Changelog**: https://github.com/CoreBunch/Instatic/compare/v0.0.2...v0.0.3