Encryption at rest for sensitive data

Sensitive data can now be encrypted with an envelope-encryption scheme backed by a cloud key management service, with key rotation support. This is opt-in and does not affect existing data until enabled.

Mandatory two-factor authentication on all API routes

2FA is now enforced across every API endpoint, including administrative routes, closing a gap where some routes were reachable without it.

Abuse protection on the public API

Added rate limiting and request size caps on public API traffic to reduce the risk of denial-of-service and abuse.

Rybbit analytics alongside Plausible

A second, consent-gated analytics provider now runs on marketing pages only, alongside the existing Plausible integration.

Immediate session revocation on removal or demotion

Removing or demoting a member now instantly invalidates their active sessions instead of waiting for natural expiry.

Stronger passkey and login protections

Passkey login attempts are now capped to block brute-force attempts, and sign-in checks have been hardened against timing-based attacks.

Tighter CORS policy

Cross-origin request rules have been tightened to reduce exposure to unauthorized origins.

Invitation tokens hashed at rest

Invitation tokens stored in the database are now hashed rather than kept in plain text.

Standardized SDK pagination (breaking change)

List responses in the v1 public SDK now use a consistent pagination format. Integrations using the old response shape will need to update.

Staging site was publicly crawlable and claiming to be canonical

robots.txt now checks the request's host and only allows crawling on the real production domain, preventing the staging environment from being indexed and from competing with production as the canonical copy.

Redis no longer stays degraded after an outage

The service now reconnects and recovers automatically after a Redis outage instead of permanently falling back to an open/unprotected state.

Mailgun webhook failures now show the real cause

Webhook handling correctly treats checks as read-only and surfaces the actual failure reason instead of a generic error.

Closed cross-tenant invitation revocation gap

Fixed an issue that could let a user revoke invitations belonging to a different organization.

Reduced information exposure on health checks and logs

Health endpoints no longer disclose unnecessary internal details, and token-refresh and audit-log entries no longer leak sensitive metadata.

Restricted redirect link schemes

Short-link redirects now only allow safe URL schemes, closing off a potential redirect abuse vector.