Tp-Note's built-in viewer serves your note over a `localhost` HTTP server so your browser can live-preview it. On a shared machine that port is reachable by every logged-in user. This release adds two **on-by-default** protections, applied in the order a connection meets them — first *who* is connecting, then binding the session to *your* browser — plus routine dependency and toolchain updates. **New — OS-user isolation (`viewer.same_user_policy`, default `"Reject"`).** When a connection arrives while the viewer is establishing the session, it checks the OS user owning the connecting process and refuses one it cannot prove belongs to you — keeping other logged-in users out from the start. Trade-off: a client the viewer cannot attribute — some sandboxed Flatpak/Snap browsers — is also refused by default and shown a page telling it to set `same_user_policy = "Off"`. **New — session-cookie binding + `Host` check (`viewer.session_binding_cookie`, default `true`).** Once your browser is the first to load the note, the viewer binds the session to it with a random `HttpOnly; SameSite=Lax` cookie; from then on every request must present that cookie, and requests carrying a foreign `Host` header are refused (DNS-rebinding defense). This blocks a hostile web page open in your own browser from reading the note. A browser configured to refuse `localhost` cookies is refused and shown a page explaining the fix — or set `session_binding_cookie = false`. **New Cargo feature `same-user-policy`** (in the default set). Build `--no-default-features` without it to drop the peer-UID check and its `netstat2` / `sysinfo` dependencies. **On upgrade:** both options ship enabled. The config-file version is tied to the release version, so your existing config is backed up and regenerated with the new defaults on first run — the protections take effect automatically. If a sandboxed or cookie-averse browser is refused, the page it is shown names the option to relax. **Build requirement:** the minimum supported Rust version is now **1.95** (raised from 1.91.1), pulled in by updated dependencies (`sysinfo` 0.39, `netstat2` 0.11.2, `tera` 2.1, `clap` 4.6.4, …). Building from source or `cargo install` now needs rustc ≥ 1.95. Both controls concern only *local* users; Tp-Note never exposes anything to the network or the Internet. **Flatpak / Snap browser users — please note.** If your browser runs in a Flatpak or Snap sandbox and the viewer shows a "403 — access refused" page instead of your note, that is the OS-user check: the sandbox hides the browser's process from the viewer, so it cannot confirm the connection belongs to you and refuses it by default. Allow it by adding this to your configuration file and restarting Tp-Note: ```toml [viewer] same_user_policy = "Off" ``` Trade-off: with `"Off"` the viewer no longer verifies the connecting OS user. Session-cookie binding stays on, though, so another local user could read your note only by winning the race to claim the session **before your browser does**, in the brief start-up window — and even then you would notice, because your own browser would be locked out and shown an error page instead of the note. Once your browser has bound the session and the note is displayed, the cookie keeps other users out. This trade-off is a concern only if you set `same_user_policy = "Off"`; with the default (`"Reject"`) you are protected anyway.