v0.79.2
August 4, 2026
Security hardening. Five fixes from an independent security review, all on the boundary between different workspaces and on what ends up in technical logs. No change to everyday use: these are barriers tightening.
-
Security
Boundaries between workspaces
An event can no longer read or copy another workspace's data by knowing an identifier: the source-object lookup is now always scoped to its own workspace, and a reference to an object in another workspace behaves like a nonexistent one, copying nothing. Publishing a flow no longer reveals other workspaces' connectors — a webhook connector check is scoped to its own workspace and its name never appears in messages. And a notification no longer goes to a user deactivated or moved between workspaces in the meantime: the recipient is re-checked at delivery, not only when the rule was defined.
-
Security
Logs and permissions
Technical rule errors no longer land in the logs with the value that caused them: an error in a code rule is logged only with its type and the rule's identifier, while the triggering value stays out of the logs. And retrying an automatic activity now requires the same role needed to complete it: an operator could previously retry someone else's automatic activity — with external requests, costs and new effects — now the completion rule applies.