Back to the changelog

• Feature

  Every organisation sends email from its own channels

  SMTP, Mailgun, SendGrid, ZeptoMail or a generic Email API: sending channels are configured from Management and ordered by priority. If the first doesn't answer, the message goes out through the next one instead of being lost. The system channel remains as a last resort. Two things worth knowing before you start: the sender domain must be verified on your provider's console, and anything passing through a generic Email API may be archived by the receiving system, notification contents included. Credentials stay encrypted and are never readable: you only see whether they're set.

• Feature

  Test send, with a real result

  The test button deliberately does not fall back to another channel: if you're testing a channel you want to know whether that one works, not whether the message went out some other way. The result is recorded even when it fails, which is exactly when you need to know. The test always goes to whoever requested it.

• Security

  Identity emails stay on the system channel

  Password resets, sign-in links and invitations go out only through the system channel, never through one configured inside an organisation. The reason is simple: whoever configures a sending channel can see its traffic, and messages that grant access must not travel that way. If the system channel isn't configured, these emails don't go out at all — a deliberate choice, preferable to routing them through a less protected path.

• Feature

  Reset your password or sign in with a link

  From the sign-in screen you can now request a password reset or a temporary sign-in link, without going through an administrator. It also covers people who were invited and haven't chosen a password yet: it's their first sign-in, not just a recovery. Resetting the password closes every open session and cancels any pending links, because after a suspected compromise a reset that left sessions alive would be useless. The screen always answers the same way, whether the address exists or not: a different message for known addresses would turn it into a tool for discovering who has an account. The quick sign-in link can be switched off if you prefer passwords only.

• Feature

  KPI formulas can read variables

  KPI formulas can now use flow and global variables, picked from a list instead of typed from memory. Variables marked as secret don't appear and can't be used: their value would end up in the clear among stored results. The KPI window also gained contextual help, with links into the guide verified automatically.

• Improvement

  KPIs travel with the exported flow

  Exporting a flow now carries its KPI definitions too. Previously the flow arrived mute at its destination and the formulas had to be rewritten by hand.

• Improvement

  Placeholder reconciliation lives in the Users page

  The view that groups unrecognised assignees sits at the bottom of the Users page — the place you reach when the real users finally get created. Each row shows where that name appears: records, tasks, phases, flow settings. If there's nothing to reconcile, the section doesn't appear at all.

• Security

  Procedure documents are no longer public

  Procedure PDFs were reachable by anyone who knew the address, and those addresses end up in browser history, screenshots and support tickets. They stayed readable even after the document was deleted. They now require valid access, and the protection covers previously uploaded files too: there's nothing to redo.

• Security

  Safer installations from the first boot

  Anyone installing FlowSharp on their own found four demo accounts with a known password and a predictable super-administrator on every boot. Demo data is no longer created unless you explicitly ask for it, and the first administrator is created through the registration path. Example credentials have been removed from the documentation and the setup scripts.

• Security

  Outbound connections are harder to hijack

  Time could pass between the moment an external address was checked and the moment the connection opened, and a hostile system could use that window to redirect the call towards the internal network. The connection is now bound to the address already verified. In the same pass, the n8n integration checks that the execution you request really belongs to the record you're consulting it from.

• Improvement

  Deleted roles no longer block saving

  A flow that referenced a deleted role could no longer be saved, and the reference was invisible in the interface: there was no way to remove it. Now only someone introducing a wrong value right now gets flagged, while anyone reopening a pre-existing configuration can keep working.