Two-factor authentication required on all admin API routes

All administrative endpoints, including top-level admin access, now require 2FA to be enabled.

Automatic session revocation on member removal or demotion

Removing or demoting a member now immediately invalidates their active sessions instead of waiting for expiry.

Encryption at rest for sensitive secrets

Secrets are now protected with an envelope-encryption scheme backed by a managed key service. This is non-breaking and only activates once the feature is explicitly configured.

Invitation tokens stored securely

Invitation tokens are now hashed before being stored, rather than kept in plain text.

Rate limiting and request size caps on public API endpoints

Added protections against abusive traffic and oversized request payloads.

Passkey login attempt limits

Added a cap on passkey login attempts to reduce brute-force risk.

Standardized pagination across the public API

List responses now follow a consistent pagination format. This is a breaking change for existing integrations relying on the previous response shape.

Completed analytics migration

Finished moving off the previous analytics provider; the old tracking integration has been fully removed.

More consistent login timing

Login checks now take a constant amount of time regardless of outcome, closing a potential timing side-channel.

Cleaner audit and token-refresh logging

Tightened what gets written to logs to avoid exposing sensitive metadata during normal operation.

Redis outages no longer cause permanent failures

The system now reconnects and recovers automatically after a Redis outage instead of staying in a failed-open state indefinitely.

Mailgun webhook errors now show the real cause

Fixed an issue where webhook read-only checks masked the actual failure reason, making troubleshooting easier.

Fixed cross-tenant invitation revocation vulnerability

An organization could previously revoke another organization's invitations; this access control gap has been closed.

Fixed information disclosure on the health-check endpoint

The health endpoint no longer exposes internal system details.

Fixed CORS misconfiguration

Cross-origin request handling has been corrected to prevent unintended access.

Fixed unsafe redirect scheme handling

Short-link redirects now only allow safe URL schemes, preventing redirect-based abuse.