Encryption at rest for sensitive data

Introduced strong, key-managed encryption for sensitive stored data, including automatic key rotation support. This is rolling out gradually and won't affect existing functionality.

Stronger account and session security

Two-factor authentication is now required for all account and admin actions, sessions are revoked instantly when a member is removed or demoted, and login now includes added protections against automated and timing-based attacks.

Better protection against abuse

Added rate limiting and request size limits to help prevent abuse and overload of the service.

Updated privacy policy

Rewrote the privacy policy for clarity and compliance, with legal links now easy to find directly in the app.

Standardized API pagination

Public API and SDK list responses now use a consistent pagination format. This is a breaking change for anyone integrating directly with the API.

Closed several security vulnerabilities

Fixed issues that could allow cross-tenant data exposure during invitation handling, information leaks in health checks and audit logs, overly permissive cross-origin requests, and unsafe redirect behavior.

Redis outage recovery

Fixed a bug where a temporary Redis outage could cause ongoing service issues instead of recovering automatically once Redis came back online.

Invitation tokens now stored securely

Invitation tokens are now hashed before being stored, reducing risk if the database were ever compromised.