Back to the changelog

• Security

  Hardened async task callbacks

  The callback endpoint used by long-running webhook tasks (typically n8n) now only accepts API keys with the dedicated **`n8nBridge`** scope, checks their expiry and that the tenant is active. Previously any tenant API key — even an activation-only or expired one — could complete other tasks. *Note: n8n workflows using the callback must be configured with an `n8nBridge` key.*

• Security

  Logo upload restricted to Admins

  Uploading the tenant logo is now reserved to **Admins** (previously any user, even read-only), with a rate limit and audit logging of uploads.

• Security

  Design-time AI respects sensitive fields

  The designer's AI generators (form, rules, scripts) now **redact sensitive fields** from the examples before sending them to the AI provider, and cap the request size — bringing design-time in line with the Data Shield protection already active at runtime.