Back to the changelog

• Security

  Secret variables in assignees

  An assignee written as an expression can no longer reference a secret variable: saving, importing, publishing, forking and editing the flow reject it with a clear error, and an already published flow leaves the task unassigned instead of writing the value in clear text. The "assignee not found" event, the notification job and the logs no longer carry the value; over MCP an assignee matching confidential case data is masked. Anyone who used a secret as an assignee should rotate it: the cleanup script scrubs the data already written.

• Improvement

  Events, scripts and documents under the same rules as the API

  The "Update data" action of an event subscription and a script's setData treat multi-file fields like the API does: you add and remove, you do not replace the list, so no document is scheduled for deletion by a partial update. A script ending with a comment no longer breaks, and every script's syntax is checked at publish time. An event used by a task of a published flow can no longer be deleted. An event activation or a sub-flow carrying a redaction placeholder in its data is rejected instead of creating a case with fake data, and documents left unlinked are moved to retention by the periodic check.

• Security

  Privacy erasure and placeholders

  An erasure request whose path does not match the shape of the data (for instance an index on a text) is rejected before touching anything, instead of being reported as completed without erasing. Redaction placeholders written with invisible characters or truncated are recognised on every write channel.

• Feature

  Contextual help in Administration and Legal hold

  "?" badges on the tenant Admin pages (new user, webhook history, name and status, logo and colours, language, demo data and scenario) and the SuperAdmin pages (new tenant, deletion, global price list and CSV import, backfill, impersonation reason), without a guide link because these pages have no chapter. The Legal hold "Reason" explains limits and inheritance to cases with a link to the governance section.

• Feature

  The AI knows the field catalogue

  "Create with AI" and progressive flow building receive, for every task type, the allowed configuration fields with limits and defaults, taken from the same catalogue that feeds the "?" badges; event subscriptions invented by the model are discarded with a warning instead of failing the detail step. The Flow Agent finds every field by name thanks to a dictionary generated from the catalogue next to the guides.

• Improvement

  Updated guide

  New paragraphs on secret variables in assignees and MCP masking, event and script data updates on document fields, event activation with placeholders, sub-flow data, privacy request paths, script syntax checking and catalogue-informed AI building.