↑ ↓ to navigate
↵ to select
esc to close
v0.13.3 Security

v0.13.3 - Platform hosts bounded, field edits scoped

The central app and API answer only on platform hostnames, blueprint field edits are bound to their parent blueprint, and search reindexes on handle changes.

Security

  • app. and api. routing now require the platform's own apex domain. A lookalike host pointed at the server (app.attacker.com, api.example.com.attacker.com) no longer reaches the signed-in application, the REST API or MCP.
  • Editing a blueprint field through its nested URL now requires the field to belong to that blueprint and match its type. Previously a crafted request could move a field, and every value on it, into another blueprint within the account.

Changes

  • /chats and mail-preview routes are app-host only, so a customer site can now serve its own page at /chats.
  • Removed the unused push-notification token endpoints and an unused UI component framework.

Fixes

  • Full-text search: renaming an entry's handle now reindexes it, so the new slug is searchable and the old one is not.