Fix: security

CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.5.1] - 2026-03-15
+
+### Fixed
+
+- **Prototype pollution** — `persistPlugin` and `syncPlugin` no longer propagate `__proto__`, `constructor`, or `prototype` keys when merging external data into state
+- **Prototype pollution via path traversal** — `setValueAtPath` in `persistPlugin` and `historyPlugin` now rejects path segments matching `__proto__`, `constructor`, or `prototype`
+- **Prototype pollution via snapshot restore** — `deepClone` in `createSvState` now skips dangerous keys, preventing polluted data from being re-applied through `rollback()`, `rollbackTo()`, or `reset()`
+- **Unvalidated localStorage data** — `persistPlugin` now validates that parsed JSON has a numeric `version` and a plain-object `data` field before applying it; invalid payloads are silently discarded
+- **Silent async validator crashes** — uncaught errors from async validators are now stored in `asyncErrors` under the relevant path instead of being re-thrown silently
+- **`saveOnDestroy` with async save functions** — `autosavePlugin` now attaches `.catch(onError)` to the save promise returned during `destroy()`, preventing unhandled rejections
+
+### Added
+
+- **`devtoolsPlugin`** — new `logValues` option (default: `false`) to opt into logging raw state values in the console; omitting values by default prevents passwords and tokens from appearing in devtools
+- **`undoRedoPlugin`** — new `maxRedoStack` option to cap the redo stack size (mirrors the main `maxSnapshots` limit)
+- **`analyticsPlugin`** — new `redact` option accepting an array of property paths whose `currentValue`/`oldValue` are replaced with `'[redacted]'` in flushed events
+- **`syncPlugin`** — incoming `BroadcastChannel` messages are now validated as plain objects and rate-limited to one per `throttle` ms interval, preventing message-flooding attacks
+
 ## [1.5.0] - 2026-02-26
 
 ### Added

CLAUDE.md

@@ -224,11 +224,11 @@ Plugins extend `createSvState` via lifecycle hooks. They are registered via `opt
 | ----------------- | -------------- | -------------------------------------------- | ------------------------------------------------------------------------ |
 | `persistPlugin`   | `persist.ts`   | Persist state to localStorage/custom storage | `key`, `storage`, `throttle`, `version`, `migrate`, `include`, `exclude` |
 | `autosavePlugin`  | `autosave.ts`  | Auto-save after idle/interval                | `save` (required), `idle`, `interval`, `saveOnDestroy`, `onlyWhenDirty`  |
-| `devtoolsPlugin`  | `devtools.ts`  | Console logging of all events                | `name`, `collapsed`, `logValidation`, `enabled`                          |
+| `devtoolsPlugin`  | `devtools.ts`  | Console logging of all events                | `name`, `collapsed`, `logValidation`, `enabled`, `logValues`             |
 | `historyPlugin`   | `history.ts`   | Sync state fields to URL params              | `fields` (required), `mode`, `serialize`, `deserialize`                  |
 | `syncPlugin`      | `sync.ts`      | Cross-tab sync via BroadcastChannel          | `key` (required), `throttle`, `merge`                                    |
-| `undoRedoPlugin`  | `undo-redo.ts` | Redo stack on top of built-in rollback       | No required options; exposes `redo()`, `canRedo()`, `redoStack`          |
-| `analyticsPlugin` | `analytics.ts` | Batch event buffering for analytics          | `onFlush` (required), `batchSize`, `flushInterval`, `include`            |
+| `undoRedoPlugin`  | `undo-redo.ts` | Redo stack on top of built-in rollback       | `maxRedoStack`; exposes `redo()`, `canRedo()`, `redoStack`               |
+| `analyticsPlugin` | `analytics.ts` | Batch event buffering for analytics          | `onFlush` (required), `batchSize`, `flushInterval`, `include`, `redact`  |
 
 ### Deep Clone System (src/state.svelte.ts)
 

README.md

@@ -564,7 +564,8 @@ devtoolsPlugin({
   name: 'MyForm', // Log prefix (default: 'svstate')
   collapsed: true, // Use groupCollapsed (default: true)
   logValidation: false, // Log validation results (default: false)
-  enabled: true // Auto-disabled in production
+  enabled: true, // Auto-disabled in production
+  logValues: false // Log raw state values in change events (default: false — avoids leaking passwords/tokens)
 });
 ```
 
@@ -604,7 +605,9 @@ sync.disconnect(); // Close the channel
 ```typescript
 import { undoRedoPlugin } from 'svstate';
 
-const undoRedo = undoRedoPlugin<MyState>();
+const undoRedo = undoRedoPlugin<MyState>({
+  maxRedoStack: 50 // Cap redo stack size (default: unlimited)
+});
 
 // Extra methods and stores:
 undoRedo.redo(); // Re-apply last undone change
@@ -621,7 +624,8 @@ analyticsPlugin({
   onFlush: (events) => sendToAnalytics(events), // Required
   batchSize: 20, // Flush at N events (default: 20)
   flushInterval: 5000, // Periodic flush ms (default: 5000)
-  include: ['change', 'action'] // Filter event types
+  include: ['change', 'action'], // Filter event types
+  redact: ['password', 'creditCard'] // Replace values for these paths with '[redacted]'
 });
 ```