v0.39.5
July 11, 2026
A security release, the outcome of a targeted audit of authentication, tenant isolation, integrations and file upload. Three areas were already solid, three points hardened: API keys now always have an expiry, automation scripts can be limited in the actions they perform, and MCP keys automatically align with the current role of whoever created them. No impact on day-to-day use — the changes are backward-compatible.
-
Security
API keys always expire
No more "forever" keys. When you create an API key (to start flows from external systems or n8n) you now set an **expiry**: **90 days** by default, customizable up to a maximum of **365**. The expiry is shown in the list, so you always know when a key is about to lapse. Keys with no end date — a risk if one is lost or forgotten — are no longer possible.
-
Security
More controllable automation scripts
You can limit what a script does. An "Auto Script" activity can now declare **which actions** it is allowed to perform (send notifications, emails, create child items, raise events, etc.). If the list is left unspecified everything works as before; if you specify it, the script can use **only** those actions. Every action a script performs is also **logged**, for better traceability.
-
Security
MCP keys aligned to the real role
Demotions are respected by MCP keys too. If a user is demoted (e.g. from Administrator to Operator), their MCP keys now **automatically align** with the new role on first use, with no need to revoke them by hand: a key cannot grant more than its creator is allowed to do **today**.