Encryption at rest for sensitive data

Secrets are now encrypted using AES-256-GCM envelope encryption with a cloud-managed key, including support for key rotation.

Two-factor authentication required on all administrative and API access

All API routes, including global admin endpoints, now require 2FA, closing a previous gap that allowed access without a second factor.

Standardized pagination across list APIs (breaking change)

SDK list endpoints now return a consistent pagination format. Existing integrations will need to update to the new response shape.

Stronger session and account security

Sessions are now revoked immediately when a member is removed or demoted, invitation tokens are hashed at rest, and login checks use constant-time comparisons to prevent timing attacks.

Reduced abuse and denial-of-service exposure

Added pre-authentication rate limiting, request body size limits, stricter redirect validation, and tighter CORS rules across the API.

Resolved outstanding dependency security alerts

Cleared all open vulnerability alerts flagged by automated scanning tools.

Fixed critical remote-code-execution vulnerability (CVE-2026-75604)

Upgraded to a patched framework release to close an unauthenticated RCE exploit.

Fixed Mailgun webhook error reporting

Webhook failures now surface the real underlying cause instead of a generic read-only error.

Fixed cross-tenant invitation revocation vulnerability

Users could previously revoke invitations belonging to another organization; this is now blocked.

Fixed information disclosure in health checks and audit logs

Health-check endpoints and audit log entries no longer expose sensitive internal metadata.

Fixed Redis outage recovery

The platform now automatically reconnects to Redis after an outage instead of remaining stuck in a failed state.