Encryption at rest for sensitive data

Sensitive fields are now protected with envelope encryption backed by a cloud key management service, with safe key rotation support. This is non-breaking and only activates once encryption is configured.

API rate limiting and request size limits

Public API endpoints now enforce IP-based rate limits and cap request body sizes to reduce abuse and denial-of-service risk.

Stronger account security enforcement

Two-factor authentication is now required on all API routes, including admin-level access. Removing or demoting a member now immediately revokes their active sessions, and passkey login attempts are now rate-limited.

Invitation tokens are now hashed at rest

Invitation tokens stored in the database are hashed rather than kept in plain text, reducing exposure if the database is ever compromised.

Tighter cross-origin request policy

CORS rules have been tightened to reduce the attack surface for cross-origin requests.

SDK: standardized pagination and list responses (breaking)

The public API now uses a consistent pagination and list response format across all endpoints. Integrations using the previous format will need to update.

Clearer Mailgun webhook error reporting

Webhook failures now surface the actual underlying cause instead of a generic error, making misconfigurations easier to diagnose.

Automatic recovery from Redis outages

The system now correctly recovers after a Redis outage instead of remaining in a failed-open state indefinitely.

Closed a cross-tenant invitation revocation vulnerability

A flaw that could allow one organization to revoke another organization's invitations has been fixed.

Removed information leaks in health checks and audit logs

Health check endpoints and audit log metadata no longer expose sensitive internal details.

Login timing consistency

Login now takes a consistent amount of time regardless of whether credentials are valid, closing a timing-based information leak.

Redirect link safety

Short-link redirects now restrict allowed URL schemes to prevent misuse.

Cleaner token-refresh logging

Token refresh events no longer log unnecessary sensitive details.

More reliable duplicate-request handling

Fixed an issue affecting the correctness of idempotency key handling for repeated requests.