Back to the changelog

• Feature

  Flow and global variables in tasks

  Variables now resolve in Webhook bodies, in Event names and data, in scripts, in Wait durations, in the data passed to sub-flows and in the AI prompts of tasks, phases and titles. Where the value used to arrive empty, it now arrives as configured: check the recipients of your integrations before publishing. The AI system prompt now goes through templates too: if it contains text with double curly braces, review it.

• Security

  Secret credentials in Webhooks, only where needed

  Secret variables are allowed only in Webhook bodies and headers and are inserted into the request only at the moment of sending: they do not stay in queued jobs or in the log. A secret is sent only if the body names it explicitly: copying a whole group of variables does not include it. In other tasks the secret is rejected on save and publish, and an already published flow that uses it stops with a clear error. Headers accept only simple variables and the address stays fixed: use connectors for managed destinations.

• Security

  Secrets hidden in the log and in responses

  If a Webhook's synchronous response sends a secret back, that field is not copied into the case data and the history keeps only the path of the omitted field; the other data stays. If the omitted part is the outcome, the task behaves as if the outcome were missing and opens human fallback, if configured. In the call log, the secrets that were sent are hidden even when repeated deeply or very short.

• Improvement

  Publish warning about secrets being sent

  When a Webhook uses a secret, the Designer warns at publish time with the keys used and the destination server, without blocking. The Designer offers secrets only where they are allowed, always hidden, and errors are explained in Italian and English.