May 2026
Implemented comprehensive server-side permission enforcement for all API endpoints. Fine-grained access control with 7 permission types (deploy, start, stop, restart, logs, config, admin) enables true multi-team security isolation. Wildcard support using 'all' or '*' simplifies administrative access management.
Added remote execution support for basic-auth, setup-traefik, and setup-dns commands via HTTP API. Developers can now manage app configuration without SSH access to servers. New --target and --local flags provide flexibility for local and remote operations.
Added Traefik HTTP basic authentication support with APR1-MD5 password hashing. Protect apps behind username/password authentication with htpasswd-compatible format. Supports pre-hashed entries for easy migration from existing authentication systems.
Comprehensive documentation updates including "no-humans mindset" guidance for preferring hotify HTTP API over SSH/scp. Added static landing page with changelog under docs/ directory for better project visibility and change tracking.