v1.0.27 - Aug 08, 2026

Secret rotation completed: all compromised identity-platform credentials (OAuth secrets, JWT signing keys, encryption keys, webhook secrets) rotated via secret manager and old credentials revoked

Forced re-login after key rotation: access and refresh tokens signed by the old JWT key are now rejected; users must log in again to receive a token signed by the new key

Security incident popup on revoked session: users whose session was revoked by the key rotation now see a security popup and a "Confirm it's you" banner instead of being silently logged out

SAML signing key hardening: removed the hardcoded SAML signing key from source code; it is now loaded only from the secret manager

Google OIDC login fix: fixed users being unable to log in via Google OIDC on Android devices