Mandatory two-factor authentication on all admin and API access

Every /api/* endpoint, including platform admin routes, now enforces 2FA, closing a gap where those routes could previously be reached without a second factor.

Runtime images now match tested, patched dependency versions

The production Docker image was pinned to an older Next.js build that never received a CVE fix already present in our lockfile. Both are now aligned (Next.js 15.5.25, Prisma 6.19.3), and a safeguard was added to catch future drift between the two.

Worker image hardened against a tar-based denial-of-service bug

Updated bundled tooling in the worker image to remove a gzip-bomb vulnerability in the file-extraction library used at build time.

Broad security hardening across authentication, data, and API layers

A member's active sessions are now revoked the moment they're removed or demoted; sensitive data is encrypted at rest with rotating keys; invitation tokens are hashed in the database; passkey login attempts are capped; and tighter request-size limits, rate limiting, CORS rules, and redirect/health-endpoint protections close a set of previously tracked security gaps (see internal security remediation tracker for full detail).

Standardized pagination and list responses in the public API (breaking change)

v1 API list endpoints now return a consistent pagination shape. Integrations using these endpoints will need to update to the new response format.

Mailgun webhook errors now show the actual cause

Webhook checks correctly respect read-only mode and now surface the real failure reason instead of masking it.

Redis reconnects automatically after an outage

Previously, a Redis outage could leave the app stuck in a failing state even after Redis recovered. It now resumes normal operation on its own.