September was a month for closing doors quietly. Most of what shipped is the kind of work you only notice when it is missing: sign-in that cannot be turned against you, two-factor changes that end every other session, email and password changes that leave a clear trail, and uploaded files cleaned of the hidden details they carry. Adding someone to your organization now starts with an invitation rather than an account, mail is quicker to open, and notifications finally arrive in your own language. Here’s the full rundown.
Sign-In That Cannot Be Turned Against You
Repeated failed sign-in attempts can no longer be used to lock someone out of their own account. Sign-in protection now limits the source making the attempts rather than the account being targeted, so knowing an email address is no longer enough to keep its owner from signing in. Failed attempts also expire on a rolling window, so an old mistyped password no longer counts towards a later lockout, and signing in successfully clears the count. Security alert emails about locked accounts are capped per recipient, so they cannot be used to flood a mailbox. Reported to us externally with a clear, reproducible proof of concept.
The sign-in response no longer reveals whether an email address belongs to an existing account, and sign-up now behaves the same way. It answers identically whether or not the address is already registered, and when it is, we email the owner, so anyone who forgot they had already signed up still finds out and can sign in rather than waiting for a verification link that was never coming. Requesting a new invitation link could reveal the same thing and was changed with it. Reported to us externally with a clear, reproducible proof of concept.
Google Sign-Up and Unlinking
Signing up with Google now completes entirely through the verified Google handshake, so an account can only be created for an address Google has confirmed belongs to the person signing up. Reported to us externally with a clear, reproducible proof of concept. Signing up and signing in with Google are now rate limited in line with email and password sign-up, and the same rules about which email domains can be used to create an account apply to Google sign-up as well.
Unlinking a Google account now asks for your password first and signs you out of your other sessions once it is done. You also get an email whenever a Google account is unlinked, so an unlink you did not perform is something you hear about straight away.
Two-Factor Authentication
Turning two-factor authentication on or off now signs you out on your other devices, so a session that was already open cannot carry on afterwards. You stay signed in where you made the change, and we tell you how many other sessions ended. Reported to us externally with a clear, reproducible proof of concept. Turning two-factor authentication off, or replacing your recovery codes, now asks you to confirm your identity first.
The mobile number that receives your security codes is now changed in Security Settings, where you confirm your identity and then verify the new number with a code sent to it. Your codes keep going to your existing number until that code is confirmed. Once the number changes we notify you and sign you out of your other sessions, so a change you did not make is visible straight away, and while two-factor authentication is on the number can no longer be edited from your profile. Reported to us externally with a clear, reproducible proof of concept.
We also fixed saving your profile from the mobile app clearing that same number. On an account with two-factor authentication turned on, it left nowhere to send a code at the next sign-in.
Email Changes and Password Resets
Only the most recent verification link for an email address change now works. A link that has been replaced, including one sent to an address entered by mistake, can no longer move your account, while correcting a mistyped address and using the new link works exactly as before. Reported through our vulnerability disclosure program.
A pending email change is now cancelled whenever your password changes, whether you change it in Security Settings or reset it after forgetting it, so recovering your account also withdraws a change that was already in progress. If you had one pending, request it again once your password is set. When a change completes, the address you moved away from now receives a message telling it that it is no longer used for signing in or for password resets. That adds to the alert already sent when the change is first requested, which arrives before the change takes effect.
The cap on password reset emails for one account now holds however the address is written. It previously counted some equivalent forms of the same address as different accounts, so a single mailbox could receive more reset emails than the cap allowed. A separate cap now bounds how much reset email any one source can trigger, and a short cooldown applies between requests for the same account. No account was ever at risk from this, because only the most recent reset link is valid, and nothing changes about how you reset your password. Reported to us externally with a clear, reproducible proof of concept.
Invitations Before Accounts
Adding someone to your organization now always sends them an invitation, and nothing is created for them until they answer it. Where the address does not have an ISO Mate account yet, choosing a password from the invitation is what creates the account and joins your organization. An invitation nobody answers no longer takes up a place in your organization or a seat on your subscription, recipients can decline, and an address that was invited but never joined stays free to sign up on its own. Reported to us externally with a clear, reproducible proof of concept.
A role that allows managing users now also allows viewing the organization’s roles. Assigning a role means choosing from that list, so a role that granted user management without it could not do the very thing it permits. Members who are not administrators also no longer see a permission error when viewing the members of the organization. The list itself always loaded, and the message came from the page also trying to load the roles, so the filter by role is now only offered to those who can use it.
Uploads Without the Hidden Extras
Images and videos you upload no longer keep the hidden details a camera records inside them, such as where a photo was taken, the date and time, and the device and software used. This applies everywhere files are uploaded, including your organization’s logo, attachments on issues, test runs, tickets, and chat messages, compliance evidence, images placed in rich text, and files on custom records. The image itself is left exactly as it was, so the quality is identical and nothing is re-saved or recompressed. Files uploaded before the change have been cleaned as well. Reported to us externally with a clear, reproducible proof of concept.
PDF attachments are now cleaned when they are uploaded. A PDF can carry instructions that run automatically when the file is opened, and a document could use them to show a message box that looked like it came from ISO Mate, for example one asking you to re-enter your password. That capability is now removed before a PDF is stored, and a document that cannot be cleaned safely is refused with an explanation. Existing attachments were cleaned as part of the same release. Reported to us externally with a clear, reproducible proof of concept.
File uploads on custom records now accept only a defined set of file types, matching attachments elsewhere in the product, and are stored under a generated name instead of the name of the file on your computer. File sizes shown for uploaded images and attachments are accurate now too. Because uploads are cleaned as they are stored, the recorded size used to describe the file as submitted rather than the file as kept.
Faster Mail
Connecting a new mailbox now brings in your recent mail straight away rather than its entire history. When you want everything, a full sync is available from your mailbox settings whenever you choose to run it. Opening a mail folder is faster as well, and large folders no longer time out.
Help Desk Refinements
The ticket form now shows the description last, below status, channel, priority, category, assigned agent, due date, and tags. Those shorter fields are the ones changed most often, and they are now reachable without scrolling past the editor.
Records linked to a ticket are easier to tell apart. Each one shows its type in its own color, long titles no longer push the rows out of shape, and the status of a linked issue, task, or incident appears as a colored chip instead of plain text.
Improvements and Fixes
- Notifications in your language: in-app notifications now arrive in the language set on your profile. Previously they were always sent in English regardless of your preference. Help desk notifications about a new reply from a requester are translated as well.
- Long text fields: descriptions, notes, comments, and other long text fields now have consistent length limits, so oversized content is refused with a clear validation message instead of being cut short or failing unexpectedly on save. The limits match what each field can actually hold, so existing content is unaffected.
- Empty console page: fixed a problem that could leave the console showing an empty page after signing in, with most of the menu missing and nothing explaining why. The console now always lands you on a page that loads, tells you when your access could not be confirmed, and offers a retry.
- Ended trials and subscriptions: an organization whose trial or subscription has ended now sees a clear explanation instead of an empty screen. Members who cannot manage billing are pointed at an administrator and can still switch to another organization or sign out, and nobody is blocked from the billing page by the very check that asks them to subscribe.
- Trial countdown: fixed the number of days remaining on a free trial, which was always a day short. A new organization now correctly shows 14 days rather than 13.
- Profile saving: saving your profile with an incorrect current password no longer applies the rest of your changes. Previously the other fields on the form were saved even though the page reported that the save had failed.
Security
Most of September’s work was security, and the larger changes are described above. Here is the rest.
- Help desk ticket separation: closed a flaw where creating a support ticket could return details of a contact or user belonging to another organization. Ticket requesters, assignees, and watchers are now always resolved within your own organization. Reported to us externally with a clear, reproducible proof of concept.
- Less personal information in API responses: details such as phone numbers and sign-in security settings are no longer included when a person is shown as an assignee, author, or member elsewhere in the product. They remain visible on your own profile.
- API token limit: the limit on active API tokens now holds when several token creations arrive at the same moment. Previously a burst of simultaneous requests could take an account slightly past its allowed number of active tokens. Reported to us externally with a clear, reproducible proof of concept.
- Organization creation limit: the limit on how many organizations one person can create is now enforced consistently, including when several are created at the same moment, so the ceiling cannot be stretched to collect additional free trials. Reported through our vulnerability disclosure program.
- Search: search fields across the platform now treat special characters in a search term as ordinary text. Previously certain characters were interpreted as pattern syntax, so a crafted term could match every record in a list and make the search far more expensive than intended. Search on custom object records received the same treatment, and the way that search is carried out internally was replaced with a safer approach.
- List sizes: lists now cap how many records a single request can ask for, and an invalid page or page size no longer fails the request. Reported to us externally with a clear, reproducible proof of concept.
- Signed-out requests: opening an ISO Mate web address in a browser while signed out now returns a clear “not signed in” response instead of a server error. Reported through our vulnerability disclosure program.
What’s Next
There is more on the way across the platform. If you haven’t tried ISO Mate yet, sign up for a free 14-day trial at isomate.io. No credit card required, full access to everything from day one.
Got feedback? Reach out at support@isomate.io or use the built-in feedback portal inside the platform. Your input shapes what we build next.