Back to the changelog

• Security

  Webhook log without credentials or confidential data

  The log of every Webhook call (address, headers, data sent and received, callback) hides passwords and tokens written in the address or headers and the values of the case's confidential fields, wherever it is read: case detail, Tasks list, calendar, extension and MCP tools, for every role. This also applies to existing logs, which can be cleaned in the database too. Everything else stays readable as before, including the link to the n8n execution. If you had written credentials directly in a Webhook's address or headers, we recommend changing them and using a connector.

• Improvement

  Warnings on credentials and confidential titles

  The Designer warns when a Webhook contains credentials in the address or headers, suggesting a connector, and when the case's calculated title reads confidential fields. In that case the title is no longer sent automatically in Webhook headers. The warnings do not block publishing.

• Security

  Updated libraries

  Updated the libraries for outgoing HTTP calls, email sending and request validation, following the security fixes published by their authors.