v2.0.0

Promptzy v2.0.0

Accounts, RLS, and Backup/Restore (security release, migration required)

Security release. Closes GHSA-x56f-9fqg-f568.

⚠️ Read before upgrading

Promptzy will look completely empty after you upgrade. Your prompts are still in your database, but they carry the old identifier and won't match your new account until you run one UPDATE. Nothing is deleted. Back up first:

CREATE TABLE prompts_backup_1x AS SELECT * FROM prompts;

Then follow DOCS/MIGRATION-2.0.md. Takes about five minutes.

What happened

1.x let the browser pick its own user_id string, and the database policy that shipped with it allowed every operation to everyone (FOR ALL USING (true)). The app-side filter was a convenience, not a boundary. On top of that, 1.x shipped a hardcoded fallback Supabase project in the client bundle, so any install that never configured credentials was reading and writing a shared database with a key published in the npm package.

What changed

• Supabase Auth email/password accounts. Ownership is a verified JWT identity now, not a string the browser picks.
• Four ownership-scoped RLS policies, one per operation, each TO authenticated and checking auth.uid()::text = user_id, with WITH CHECK on insert and update.
• REVOKE ALL ON prompts FROM anon, so unauthenticated requests are refused before RLS is consulted.
• Hardcoded fallback project removed. No credentials means a setup screen, not a silent connection somewhere else.
• Delete now filters by owner as well as id.
• New: Backup & Restore in Settings. One-click JSON export, and an importer that reads both Promptzy's format and raw Supabase table rows.
• New: RLS enforcement probe in Settings → Diagnose, so you can confirm the old policy is gone.
• VITE_SUPABASE_URL / VITE_SUPABASE_ANON_KEY are actually read now. Docker builds that set them were previously still landing on the fallback project.
• 96-test Vitest suite covering credential resolution, prompt mapping, signed-out guards, error classification, backup/restore parsing, and the shipped SQL.

Breaking

• A Supabase project must be configured. There is no built-in database.
• An account is required, and existing rows must be re-pointed at it.
• setCustomUserId removed. getPromptsFromSupabase / savePromptToSupabase / deletePromptFromSupabase renamed to getPrompts / savePrompt / deletePrompt, with the writes returning { ok, error }.
• getCurrentUserId returns string | null.

Full detail in the CHANGELOG.

Reported by @Tanjot-Singh-cyber.

v1.4.4

Promptzy v1.4.4 is a small polish and security maintenance release. Cleans up the app styling, removes gradient text, tones down hover glows, updates vulnerable dependencies, and includes packaging/security fixes for the Electron desktop build.

v1.4.3 - Electron UI, Linux installers, Docker build, Updated AI Assistant and UI theme

[1.4.3] - 2026-03-02

Added

• 📚 Documentation Site: Full Starlight (Astro) docs site in /website, deployed to promptzy-docs.pinkpixel.dev
  • Installation guide covering PWA, npm (promptzy command), Docker (all modes), Linux desktop app, and clone-from-source
  • Supabase setup walkthrough with full SQL schema and step-by-step configuration
  • AI Assistant guide covering Pollinations API key setup, model selection, and technical details
  • Prompt Engineering guide with best practices for System, Task, Image, and Video prompts
  • 12 ready-to-use prompt templates (system personas, task prompts, image/video prompts)
  • Dark glassy theme: deep navy + rose pink + cyan + amber matching the app's palette
  • Wrangler-ready for Cloudflare Pages deployment (wrangler.toml included)
• 🔗 Docs Link in Header: New "Docs" button in the app header (rose-pink accent) linking to the docs site

[1.4.2] - 2026-03-01

Added

• 🖥️ Electron Desktop App: Native desktop application built with Electron 34
  • Custom app:// protocol serves the built SPA from dist/ — react-router BrowserRouter routes work identically to the web version
  • Secure architecture: contextIsolation: true, nodeIntegration: false, sandboxed renderer, minimal contextBridge surface
  • Native app menu with File / Edit / View (zoom & fullscreen) / Window / Help (GitHub & Pink Pixel links)
  • Right-click context menu for cut/copy/paste in editable fields
  • All external links open in the system browser via shell.openExternal
  • macOS traffic-light / hiddenInset title bar; proper dock behaviour
  • Dev mode loads the Vite dev server (http://localhost:8080) automatically
• 📦 Linux Binary Releases: Pre-built Linux packages published to Cloudflare R2
  • Debian / Ubuntu / Mint (.deb): Promptzy-1.4.3-amd64.deb
  • Universal Linux (.AppImage): Promptzy-1.4.3.AppImage
• 🐳 Docker Support: Multi-stage Docker build for self-hosted deployments
  • Stage 1 — Node 20 Alpine compiles the Vite SPA with optional VITE_* build args for baking in credentials
  • Stage 2 — Nginx 1.27 Alpine serves static assets; SPA-aware try_files routing, security headers, gzip compression, and smart cache policies (immutable for hashed assets, no-cache for HTML)
  • docker-compose.yml for one-command spin-up: docker compose up --build
  • New npm scripts: docker:build, docker:run, docker:up, electron:dev, electron:build