v1.0.28 - Aug 12, 2026
Last updated
Last updated
Restore-user event for integrations: IDP now fires a restore-user event to integrated services (e.g. Chat) when an admin restores a deleted user, so the original profile and history are re-activated instead of a new identity being created
Proxy5xxBurst alert noise: Blocked malicious/pentest API requests now return a 4xx status instead of 5xx, removing false alert noise from the Proxy5xxBurst monitor
Per-asset-class encryption keys: Client secrets and the SAML signing key are now encrypted with separate, purpose-scoped AES keys instead of sharing a single key
Refresh-token pepper hardening: Removed the hardcoded refresh-token HMAC pepper from source code; the pepper now lives in configuration and can be rotated