Post #4374805

For the infosec peeps, what the security pass actually fixed: Inbound email replies are now sender authenticated (DKIM/SPF with domain alignment) and have to quote a per-cycle code. Before, a spoofed From header could disarm anyone's switch, indefinitely, if you knew their address. Check-ins need an explicit POST now. Mail link scanners could fetch the confirm URL and check people in automatically. PINs are argon2id instead of one round of SHA-256. Rate limits on every auth path. CSRF tokens, strict CSP, Secure cookies, no more data races. And as mentioned, the duress PIN is also indistinguishable from a normal check-in now, same pages, same timing, so nobody watching your screen learns anything. If you self-host this or run a fork, update. Everything above applies to older versions.