Security work rarely makes for glamorous release notes — which is exactly why we want to document it. This sweep went deep across the platform:
- Tenant isolation — enforced on every space-scoped route and locked in with dedicated regression tests
- Request hardening — SSRF blocked, webhook replay prevented, token log leaks closed, invite responses trimmed of over-disclosure
- CORS done right — the public delivery API stays open for any site that consumes content, while the management API is locked to an allowlist
- Upload safety — active-content uploads blocked, image processing guarded against decompression bombs, asset delivery hardened
- Auth endpoints — account enumeration stopped on one-time-token endpoints and OTP login throttled
- Editor safety — CMS-controlled markup sanitized in the editor UI
All of it ships as defaults. There is nothing to configure — every space simply got safer.