Concerns: pushword/admin, pushword/core, pushword/dev-app, pushword/flat, pushword/page-scanner, pushword/repurpose, pushword/static-generator
New Docker files disable PHP version disclosure and generate a forced-change random password when no production administrator password is configured. Sites that already copied the Docker skeleton should merge docker/php.prod.ini and docker/docker-entrypoint.sh, or rerun pw:docker:init --force only if those files have not been customised.
Remember-me now follows its checkbox, drafts require an editor session, flat lock APIs require ROLE_EDITOR, and authenticated pages are not browser-cacheable. Cheatsheet and Repurpose creation links now open a POST confirmation. No site change is required.
Page-generated files cannot escape their configured directories, SVG responses are sandboxed, and external link checks block private networks while verifying TLS. Review the security model before granting editorial access. Run pw:image:cache once to remove legacy public SVG symlinks.