Two-factor authentication now enforced on all account and admin actions

All API and admin routes now require 2FA, closing a gap that previously allowed some actions without it.

Sensitive data encrypted at rest

Secrets and invitation tokens are now encrypted/hashed using a managed key, with safe key rotation built in.

Standardized pagination for API list responses

All list endpoints now return pagination in a consistent format. This is a breaking change for integrations built on the previous API shape.

Privacy policy rewritten and legal links surfaced in-app

Updated for OAuth app verification requirements, with easier access from within the product.

Sessions now revoked immediately on member removal or demotion

Prevents a removed or demoted member from continuing to use an already-active session.

Stronger protections against brute-force login attempts

Added attempt caps on passkey login and constant-time checks to prevent timing-based attacks.

Better protection against abuse and denial-of-service attempts

Added rate limiting on public API endpoints and caps on request size.

Reduced information exposure in health checks, logs, and redirects

Tightened CORS rules, restricted redirect schemes, and removed sensitive details from health-check and audit-log output.

Redis now recovers automatically after an outage

Previously, an outage could leave the system permanently degraded until manually restarted.

Fixed worker build failure that could block entire deployments

A startup failure in the worker build was previously able to halt the whole deploy.

Resolved critical and high-severity vulnerabilities in deployment images

Upgraded the underlying base image and tooling, eliminating a critical and several high-severity CVEs.

Fixed a cross-tenant access issue in invitation revocation

Closed a flaw that could allow invitation revocation across organization boundaries.