Vault ciphertext and encryption metadata now change in a single database transaction, so a rotation can't leave them out of step. New and rotated custom vault keys use salted memory-hard derivation, and older vaults stay readable until you choose to rotate them.

Custom vault keys are now sent Base64-encoded in the X-Vault-Key-B64 header, so non-Latin characters and symbols work in every browser.

Password resets: resetting a password now revokes browser sessions, CLI tokens, and MCP authorizations.
Google accounts: sign-in and registration are separate flows, which prevents accidental account creation. Sign-in and account linking require explicit, verified account states.
Two-Step Verification: the screen shows only the methods active on your account, and disabling 2FA requires your password or an authenticator code. Existing passkeys can be enabled for 2FA with one click during onboarding.
Account privacy: MFA method discovery no longer reveals whether an account is enrolled.

#Request protection

ApiVault now has same-origin mutation protection and baseline browser security headers. Email verification routes are guarded, and anonymous CLI connection requests are rate limited.

Learn more in the authentication guide.

#Sign-in and sessions

#Request protection