Back to the changelog

• Security

  Full security hardening (codebase audit)

  Closed a security audit with 9 fixes on the product's "side" boundaries. In short: deactivating a tenant now really blocks every machine-to-machine integration (API keys, extension tokens, MCP keys, n8n callbacks), not just UI access; the Chrome extension's CORS is restricted to an explicit allowlist of official IDs instead of accepting any extension; super-admin impersonation is blocked on deactivated tenants; item creation via MCP now follows the same rules as REST (activation mode, start policy); the legacy task-complete route now validates that the task belongs to the item and the caller is assigned; the production deploy is aligned (mandatory secrets on every service, demo seed off by default); dependencies updated to clear known advisories.

• Security

  Flow-scoped API keys

  API keys generated from a flow's designer are now valid only for that flow, no longer for every published flow in the tenant. The trigger endpoint rejects a key used on an unauthorised flow. Keys created from Settings → API remain tenant-wide (clearly stated). Every key creation/revocation is now recorded in the audit log.

• Security

  Events: who can raise them

  Each event definition can now restrict which roles may raise it via the API (/events/raise), using system roles or custom roles. The default is unchanged (any Operator or above), so existing configurations keep working.

• Improvement

  Flow folders: two fixes

  Moving a flow into a folder now works (it previously failed with "Move error") and the folder's flow counter updates immediately, without a page reload. Also fixed the "move to folder" menu, which was being clipped inside the card.

• Improvement

  Flow Agent: today's date and multilingual messages

  The agent now knows today's date: asking for "by tomorrow" yields the correct date (it could previously propose old dates taken from the model). The agent's generated messages (start confirmation, missing data, started) are now in the interface language (Italian/English), with no extra AI calls — so no added cost or latency.