Encryption at rest for sensitive data

Sensitive fields are now protected with an AES-256-GCM envelope keyring backed by a cloud key-management service, with safe key rotation. This is opt-in and only activates once configured, so no disruption to existing deployments.

Rate limiting and request-size protections on the public API

Added pre-authentication IP rate limiting and request body size caps to reduce abuse and denial-of-service risk.

Passkey brute-force protection

Repeated passkey login attempts are now capped to block brute-force attacks.

Two-factor authentication enforced on all API routes

2FA is now required across the entire API, including administrative routes, closing a gap where it could previously be bypassed.

Immediate session revocation on removal or demotion

When a member is removed or demoted, their active sessions are invalidated right away instead of remaining valid.

Invitation tokens hashed at rest

Invitation tokens are now stored hashed rather than in plain text, reducing exposure if the database is compromised.

Tighter CORS and redirect controls

Cross-origin access rules and short-link redirect schemes were locked down to prevent misuse.

Standardized SDK pagination and list responses (breaking change)

All list endpoints now return a consistent pagination shape. Integrations using the SDK will need to update to the new response format.

Automatic recovery after Redis outages

The platform now recovers cleanly once Redis comes back online, instead of remaining stuck in a degraded state.

Cross-tenant invitation revocation vulnerability

Fixed a bug that could allow an invitation to be revoked across organization boundaries.

Reduced information leakage in logs and health checks

Removed sensitive details that were being exposed via audit logs, token-refresh logs, and the health-check endpoint.

Timing-safe login checks

Login verification now runs in constant time, closing a timing-based side channel.