v0.93.5
October 3, 2026
More webhook security fixes, and interface improvements: webhook signatures now carry a timestamp that prevents reusing them later, an organization can no longer saturate inbound webhook bandwidth with a few very large deliveries, an installation without a configured external address works correctly again, the Users page flags Super Admins, and the Designer blocks saving on an invalid number.
-
Security
More webhook security fixes
Webhook signatures, both inbound and outbound, now also carry a timestamp: an intercepted signature can no longer be reused later to replay the same call. An organization receiving webhooks with a few very large deliveries can no longer saturate its own bandwidth without the system noticing, regardless of the number of calls. The history of raised events now cleans itself up automatically after a retention period, just like other technical logs already do. An installation that has no separate external address configured for the site works correctly again: it could previously block every save, including login. If you verify the signatures of webhooks FlowSharp sends to your systems (event subscribers, alerts), update your verification to the new timestamped format: the Integrations guide shows the updated example.
-
Improvement
Users page: Super Admins are now easy to spot
The Users page now shows a label on Super Admin accounts; for anyone who isn't a Super Admin, the actions on that account (role, status, password reset, delete, save, unlock, sessions) are disabled with a short note, instead of finding out they're rejected only after trying them.
-
Improvement
Flow Designer: an invalid number blocks saving
In the Designer, «Save» now stays disabled (with an explanation) as long as any number field — AI task, System One/Jev questions, retry, webhook, phase or flow settings — shows an invalid value, instead of saving anyway with the last accepted value. In the Document field, an invalid maximum file count instead blocks «Add» on the field's form.