Back to the changelog

• Security

  Hardened async task callbacks

  The callback endpoint used by long-running webhook tasks (typically n8n) now only accepts API keys with the dedicated n8nBridge scope, checks their expiry and that the tenant is active. Previously any tenant API key — even an activation-only or expired one — could complete other tasks. Note: n8n workflows using the callback must be configured with an n8nBridge key.

• Security

  Logo upload restricted to Admins

  Uploading the tenant logo is now reserved to Admins (previously any user, even read-only), with a rate limit and audit logging of uploads.

• Security

  Design-time AI respects sensitive fields

  The designer's AI generators (form, rules, scripts) now redact sensitive fields from the examples before sending them to the AI provider, and cap the request size — bringing design-time in line with the Data Shield protection already active at runtime.