#What's Changed

[Security] Failed sign-in attempts are now rate limited per account and per source address — 10 password attempts and 5 authenticator-code attempts per 15 minutes. Previously a six-digit second factor could be guessed without limit. A completed sign-in clears the counter.
[Security] Wrong custom vault keys are now rate limited (10 per 15 minutes, counted per user so one project member cannot lock out their team-mates), closing an online guessing path against the stored vault-key hash on the reveal, export, import and rotate endpoints.
[Security] Every response now carries a nonce-based Content Security Policy with strict-dynamic, so a script injected through stored content such as a key name or note cannot execute. Added Strict-Transport-Security alongside it.
[Security] CLI tokens now expire 90 days after approval instead of lasting forever, and their expiry is shown in Settings → Sessions & Devices. Tokens issued before this release keep working until revoked.
[Fix] Project, ProjectMember, ProjectInvitation and RequestLog existed only in a hand-run SQL script that Prisma never reads, so a fresh deployment came up missing four required tables. They are now part of the migration history, along with ApiKey.projectId and User.username.
[Security] Corrected the ProjectMember.role column default in the production database, which the original hand-run migration script had set to "owner" instead of "member". Application code always sends an explicit role, so no membership was ever created incorrectly.
[Fix] The logs page no longer crashes when the project list fails to load: four hooks ran after an early return, so React tore the tree down instead of showing the loading skeleton.
[Fix] Accepting a stale invitation can no longer lower an existing role — previously an old viewer invite accepted after a promotion or ownership transfer silently demoted the user.
[Fix] Marking notifications read or deleting them no longer reports success when the write failed, and the unread badge counts all unread notifications instead of capping at the 50 most recent.
[Fix] Deleting the active project now moves the selection to a remaining project instead of stranding the dashboard on its loading skeleton.
[Fix] Only the newest release per product is labelled “Latest” in the changelog. Every entry had been shipped with the flag set, so 14 older web releases and 2 CLI releases all claimed to be current.
[Improvement] Vault key rotation derives keys before opening its transaction and raises the transaction timeout, so rotating a project with hundreds of keys no longer aborts on Prisma's 5-second limit. A rotation that races with another now fails safely instead of re-encrypting with a stale key.
[Improvement] Malformed date filters on the logs endpoint return 400 instead of surfacing as a 500.