#What's Changed

[Security] New and explicitly rotated custom vault keys use salted memory-hard derivation while legacy vaults remain readable until voluntary rotation.
[Security] Vault ciphertext and encryption metadata now change in one transaction, and future password resets revoke browser, CLI, MCP, and short-lived authorization credentials together.
[Security] MFA method discovery no longer reveals account enrollment, and anonymous CLI connection requests are rate limited.