Added share codes for read-only list sharing — anyone with a share code can view a list at /List/{code} without logging in. Owners can see their edit code and share code on the favourites page with copy-to-clipboard buttons and an eye-toggle for the edit code. New /Access page lets visitors enter a share code.
Redesigned the list creation flow: users now only choose a list name and the system automatically generates a strong random password (GUID). The password is shown once after creation in a copy-friendly banner on the favourites page. Sign-in label changed from "Password" to "List Key" for clarity.
Added rate-limiting to login and registration endpoints (5 requests per minute). Hardened Full-Text Search query sanitization to whitelist-only alphanumeric, spaces, hyphens and underscores with a 50-character cap. Fixed XSS vulnerability in the notes feature by removing inline JSON serialization and using dataset attributes instead.
New /Changelog page to track updates and improvements. Entries are loaded from the YassChangelog database table and displayed in a responsive, styled list.
Fixed a 400 Bad Request error when toggling favourites from the search page. The anti-forgery token form was moved to the shared layout so it is available on every page.