# Batoi Press 0.9.0

Batoi Press 0.9.0 adds a repeatable security baseline check for the main pre-1.0 hardening controls.

## What Changed

- Added `php radpress/tests/security_baseline.php`.
- Verified installer lock configuration and installer lock handling references.
- Verified private Apache deny rules for `radpress/`, app, config, content, and data directories.
- Verified public web-root rewrite and executable entrypoint rules.
- Verified upload allowlist behavior, executable upload rejection, and generated safe filenames.
- Verified CSRF token acceptance and rejection behavior.
- Verified file-backed rate limiting behavior.
- Verified role-route and author-owned post governance helpers.
- Updated security documentation to remove outdated role-enforcement follow-up wording.

## Compatibility

This release is backward compatible with the v0.8.x content format, theme templates, public routes, installer layout, release manifest structure, and update package model.

## Verification

Admin, update, static-export, access-control, security, package-structure, checksum, and manifest checks passed before publication.

## Follow-Up

Use v0.9.0 as the final pre-1.0 baseline before deciding whether remaining checklist items should block `1.0.0` or become documented post-1.0 follow-ups.
