Security
- Repeated failed sign-in attempts can no longer be used to lock someone out of their own account. Sign-in protection now limits the source making the attempts rather than the account being targeted, so knowing an email address is no longer enough to keep its owner from signing in. Reported to us externally with a clear, reproducible proof of concept.
- The sign-in response no longer reveals whether an email address belongs to an existing account.
- Failed sign-in attempts now expire on a rolling window, so an old mistyped password no longer counts towards a later lockout, and signing in successfully clears the count.
- Security alert emails about locked accounts are now capped per recipient, so they cannot be used to flood a mailbox.
- Signing up with Google now completes entirely through the verified Google handshake, so an account can only be created for an address Google has confirmed belongs to the person signing up. Reported to us externally with a clear, reproducible proof of concept.
- Signing up and signing in with Google are now rate limited in line with email and password sign-up, and the same rules about which email domains can be used to create an account now apply to Google sign-up as well.
- Turning two-factor authentication on or off now signs you out on your other devices, so a session that was already open cannot carry on afterwards. You stay signed in where you made the change, and we tell you how many other sessions ended. Reported to us externally with a clear, reproducible proof of concept.
- Turning off two-factor authentication, or replacing your recovery codes, now asks you to confirm your identity first.
- Changing the mobile number that receives your two-factor security codes now happens in Security Settings, where you confirm your identity and then verify the new number with a code sent to it. Your codes keep going to your existing number until that code is confirmed. We notify you when the number changes and sign you out of your other sessions, so a change you did not make is visible straight away. The number is no longer editable from your profile while two-factor authentication is on. Reported to us externally with a clear, reproducible proof of concept.
- Fixed saving your profile from the mobile app clearing the mobile number your security codes are sent to. On an account with two-factor authentication on, that left the account with no number to send a code to at the next sign-in.
- A verification link for changing your email address can no longer be used once a newer change has been requested. Only the most recent link works, so a link that has been replaced, including one sent to an address entered by mistake, can no longer move your account. Correcting a mistyped address and using the new link works exactly as before. Reported through our vulnerability disclosure program.
- A pending email change is now cancelled when your account password changes, whether you change it in Security Settings or reset it after forgetting it. Previously an outstanding change survived, so recovering your account did not withdraw a change that was already in progress. If you had one pending, request it again once your password is set.
- Confirming an email change now notifies the address you moved away from. The existing alert is sent when a change is requested, which is before it takes effect, so this adds a message once it completes telling the previous address that it is no longer used for signing in or for password resets.
- The cap on how many password reset emails can be requested for one account is now applied consistently. It previously counted some equivalent forms of the same email address as if they were different accounts, so more reset emails could be triggered for one mailbox than the cap allowed. The limit now follows the account itself however the address is written, a separate cap bounds how much reset email any one source can trigger, and a short cooldown applies between requests for the same account. No account was ever at risk from this, since only the most recent reset link is ever valid, and nothing changes about how you reset your password. Reported to us externally with a clear, reproducible proof of concept.
- Unlinking a Google account now asks you to confirm your password first, and signs you out of your other sessions once it is done. You will get an email whenever a Google account is unlinked, so an unlink you did not perform is something you hear about straight away.
- Closed a flaw where creating a support ticket could return details of a contact or user belonging to another organization. Ticket requesters, assignees and watchers are now always resolved within your own organization. Reported to us externally with a clear, reproducible proof of concept.
- Reduced the personal information carried in our API responses. Details such as phone numbers and sign-in security settings are no longer included when a person is shown as an assignee, author or member elsewhere in the product, and remain visible on your own profile.
- Hardened the API token limit so it holds when several token creations arrive at the same moment. Previously a burst of simultaneous requests could take an account slightly past its allowed number of active tokens. Reported to us externally with a clear, reproducible proof of concept.
- Search fields across the platform now treat special characters in a search term as ordinary text. Previously certain characters were interpreted as pattern syntax, so a crafted term could match every record in a list and make the search far more expensive than intended.
- Search on custom object records received the same treatment, and the way that search is carried out internally was replaced with a safer approach.
Improvements
- Long text fields such as descriptions, notes and comments now have consistent length limits, so oversized content is refused with a clear validation message instead of being cut short or failing unexpectedly on save. Limits match what each field can actually hold, so existing content is unaffected.
Fixes
- Fixed a problem that could leave the console showing an empty page after signing in, with most of the menu missing and nothing explaining why. The console now always lands you on a page that loads, tells you when your access could not be confirmed, and offers a retry.
- An organization whose trial or subscription has ended now sees a clear explanation instead of an empty screen. Members who cannot manage billing are pointed at an administrator, and can still switch to another organization or sign out.
- Members of an organization without an active subscription are no longer blocked from the billing page by the very check that asks them to subscribe.
- Saving your profile with an incorrect current password no longer applies the rest of your changes. Previously the other fields on the form were saved even though the page reported the save had failed.
- In-app notifications now arrive in the language set on your profile. Previously they were always sent in English regardless of your language preference.
- Help desk notifications about a new reply from a requester are now translated rather than English only.