Plans to address HTTP fallback, Electron security settings, and token storage? #98

Hi! I’m interested in using Liner, but I have a few security questions.

1. HTTP fallback in v0.1.35

baseUrl.ts switches to http://edge.tryliner.fun:10518 when the primary API is unavailable. Since authentication requests also use this API base, it looks like passwords and session tokens could be sent without transport encryption.

I see the fallback is disabled in main. Has this fix reached users through an OTA update, or does it require a new release?

2. Electron security settings

main.ts sets both sandbox: false and webSecurity: false.

What requires these settings, and are there plans to enable these protections?

3. Token storage

auth-session.ts stores access and refresh tokens in localStorage.

Are there plans to move sensitive tokens to OS-backed secure storage and limit their exposure to the renderer?

Could you clarify which of these are planned fixes and which are intentional design choices? If fixes are planned, is there a target release?

Thanks!