Failed attempts are now rate limited across all web, CLI, and MCP endpoints, and throttled requests return a Retry-After header:

Passwords: 10 attempts per 15 minutes.
Authenticator codes: 5 attempts per 15 minutes.
Custom vault keys: 10 attempts per 15 minutes, per user and per IP.

#Other security changes

Content Security Policy: every response now has a nonce-based policy with strict-dynamic, plus Strict-Transport-Security.
CLI tokens: newly approved tokens expire after 90 days.
Audit logs: failed and denied key requests, such as wrong vault keys, throttled reveals, and read-only role refusals, are now recorded with their status code, error code, and attempted event type.

#API changes

The X-Project-Id header, projectId query parameter, and project log endpoints now accept a project slug as well as an ID. The logs endpoint can also filter by explicit status codes and log ID prefixes.

#Fixes

Stale invitations can no longer demote existing members.
Vault key rotation now has a longer transaction timeout for large vaults.

Learn more in the limits reference.