Skelet 0.2.1

Secret scanning in CI. A gitleaks job scans the whole history on every push and pull request to main and develop; reviewed test fixtures are listed in .gitleaksignore.

Core requires the SDK at v0.1.0, the version it declares, instead of v0.0.0, so a plugin in its own repository can fetch core once the module tags (apps/backend/core/vX.Y.Z, apps/backend/sdk/vX.Y.Z) are pushed. The release guide covers tagging them.

Browser uploads work behind the shipped CSPs. The dashboard, storefront and Caddy policies only allowed connections to their own origin, so every upload to object storage was refused. UPLOAD_ORIGINS in the root .env names the hosts uploads go to and joins connect-src in all three; dev allows its local hosts on its own. ./skelet release now passes a Dockerfile’s build arguments through from your shell or the root .env, which it never did.

The demo storefront’s tab icon is Skelet’s, not the Vercel triangle create-next-app left behind.