New: Premium chapter gate — mark any chapter as Premium; non-logged-in readers see a 200-word teaser with fade-out and a login prompt instead of the full content
2.2.4
Fix: remove license key input and external API call from free plugin; Pro page now links to fictbase.com with manual install instructions (WP.org Guideline 6)
Fix: remove assets/ folder (banners, icons, screenshots) from plugin zip — these are uploaded to SVN assets/ separately after approval
2.2.3
Fix: move all inline <style> and <script> blocks to wp_enqueue_style / wp_add_inline_style / wp_add_inline_script per WP.org guidelines
Fix: change story/chapter management capability from manage_options to edit_posts; authors may only edit their own stories
Fix: remove Plugin_Upgrader auto-install and activate_plugin from free plugin to comply with WP.org guideline 8
Fix: remove custom CSS setting from free plugin (use WP Customizer for site-wide CSS)
Fix: REST track_view endpoint now rejects unpublished chapters
Fix: admin menu position moved to 58 (below all core WP items)
2.2.2
Improvement: update plugin description and tags for clarity
2.2.1
Fix: add missing translators comments to all plural/placeholder i18n strings
Fix: wrap all printf() integer arguments with absint() to satisfy output escaping requirements
Fix: use %i placeholder for table name in SQL query to avoid string interpolation
Fix: escape emoji icon output with esc_html() in story and status grids
2.2.0
Security: HMAC-sign license data stored in the database to detect direct tampering
Security: remove development bypass — FICTBASE_API_URL must be configured for license checks
Fix: PHP 8 compatibility for WP REST API validate_callback (ArgumentCountError on PHP 8 when using native function strings)
Fix: Pro gate enforced on all bookmark REST endpoints
Fix: IDOR validation added to bookmark save endpoint (chapter must belong to the requested story)
Fix: story delete now uses $wpdb->prepare() with placeholders for chapter_views cleanup
Fix: wrap fb_stories_filter_url() in function_exists to prevent fatal on pages with multiple shortcodes
Improvement: license grace period (72h offline) now also verifies HMAC of cached data
2.1.0
Add reader bookmarks (Pro) — save and resume reading position