Encryption at rest for sensitive secrets

Introduced an AES-256-GCM envelope encryption scheme backed by a cloud key management service, with support for key rotation. This is non-breaking and only activates once the key management integration is configured.

Privacy policy rewritten and surfaced in-app

The privacy policy has been rewritten for clarity and compliance, and legal links are now visible directly in the app.

Standardized pagination for list endpoints (breaking change)

Public API list responses now use a consistent pagination format. Integrators calling these endpoints directly will need to update their request/response handling.

Stronger login and session security

Two-factor authentication is now enforced on all API routes, including admin-level access. Sessions are immediately revoked when a member is removed or demoted, passkey login attempts are rate-limited, and login checks now run in constant time to resist timing attacks.

Reduced abuse and overload risk on public endpoints

Added rate limiting and request size caps on public API traffic to protect against denial-of-service and abuse attempts.

Tightened sharing and cross-origin security

Restricted allowed redirect link formats and tightened cross-origin access policy to close off potential misuse vectors.

Invitation tokens now hashed at rest

Closed a security gap where invitation tokens were stored in plain, readable form.

Closed cross-tenant invitation revocation issue

Fixed a flaw that could have allowed one organization to revoke another organization's invitations.

Reduced information exposure in system logs and endpoints

Fixed health-check and audit-log issues that could leak internal system details or sensitive metadata, and cleaned up token-refresh logging.

Fixed duplicate-request handling

Corrected an issue where idempotency keys weren't reliably preventing duplicate requests from being processed twice.

Redis no longer stays degraded after an outage

Redis now automatically recovers after a connection outage instead of remaining in a permanently failed-open state.