v12.3.6

thedotmack/claude-memv12.3.6Apr 20, 2026by thedotmack

AI Summary

Fixed an issue where the rate limiter from v12.3.3 was causing 'Rate limit exceeded' errors for the live viewer. Removed the rate limiter entirely since the worker is localhost-only (enforced via CORS), making rate limiting unnecessary security theater.

Key Highlights

Removed rate limiter entirely (300 req/min)
Kept 5 MB JSON body limit
Kept path traversal protection
Kept Localhost-only CORS
No upgrade action required

New Features

Rate limiter removal for localhost-only worker

Full Release Notes

## Viewer fix: drop the rate limiter

v12.3.5 kept the 300 req/min rate limiter from v12.3.3's "security hardening" bundle. That tripped the live viewer within seconds (it polls logs and stats) and served it "Rate limit exceeded" errors.

**Fix**: remove the rate limiter entirely. The worker is localhost-only (enforced via CORS), so there's no abuse surface to protect. Rate-limiting a single-user local process is security theater.

### Still kept from v12.3.3 hardening
- 5 MB JSON body limit
- Path traversal protection
- Localhost-only CORS
- Everything else from v12.3.5

No upgrade action required.