Changelog

2026-09-15 -- Security Hardening

Security

• is_workspace_admin() now checks for the Owner or Admin role instead of treating every signed-in user as an admin
• Column-level grants on profiles -- users can only update full_name, avatar_url and title
• Added SET search_path = '' to all SECURITY DEFINER functions

Infrastructure

• Added drop_all.sql for clean database resets

---

1.0.0 (2026-09-07)

Initial Release

• 44 routes across boards, sprints, roadmap, analytics, and settings
• 31 Supabase tables with RLS policies and triggers
• Supabase Auth with email, Google, and GitHub OAuth
• Kanban board with drag-and-drop and database persistence
• Sprint cycles with burndown and velocity tracking
• Modules, goals, wiki pages
• Team management and workspace settings
• Light and dark mode with oklch tokens