Take the removed copy guard out of prebuild and test
847365e deleted **************** but committed only the deletion: package.json still ran it in prebuild and test, and the web services evidence page still quote...
Stop failing the site build on what the translation service returns
check-copy-punctuation.mjs judged translated values by length, repetition and punctuation, and failed the image build when it disliked one. The dictionary sync ...
Release idle Hikari connections; liveness off the DB-aware health
Same changes the other services got on 2026-09-16, held back until the lead import this service was running finished. Keep the pool maximum but let idle connect...
My Scheduled Webinars and Join Existing read the booking the server actually sends
The Support badge now takes a presenter to My Scheduled Webinars when a session is booked with them (mediaservice 0212445). That tab — and the wizard's Join Exi...
The scheduler lists the org's webinar types, and a booking badges its presenter
/support/schedule-webinar said "No webinar types are currently available." for every organization, however many types it had. The wizard loads its picker from G...
A presenter's viewed stamp, so a booked session can badge them
The Support icon's webinar count reads WebinarAttendee.dateViewed. A presenter is not an attendee row, so a session booked with them was emailed and then never ...
A live demo button beside Start Free Forever
The home hero offered two things: start free, or read the pricing. It now also offers half an hour with a person. "Book a Live Demo", with "30 minutes" on a sec...
Short one-time codes can no longer be guessed without limit
Every short code the platform mails or texts was checked with no count: - POST /api/recover/email/verify-code took the 8-hex-character reset code ALONE and mat...
No OAuth client secret in kamo-internal's source; the anonymous token route is gone
**************** assigned the client-credentials secret for four production client ids (kamo:1:crm:internal, kamo:4:kamo:internal, kamo:5:ebonix:internal, kamo:...
A page for unlimited email campaigns and drips, linked from everywhere it belongs
/email-marketing sells what shipped on 2026-09-16 (broadcast campaigns, drips, sending domains): unlimited, and 100% free with Business and Enterprise. The pag...
Integration forms send only the credentials that were typed
The org CalDAV/CardDAV tab sent all four server fields on every save of an Apple or custom server. The fields never show what is stored, so they were empty, and...
Saving a calendar/contacts integration never blanks or drops its stored credentials
A contact integration's credentialsJson was replaced by whatever a save sent. The org CalDAV/CardDAV tab sends all four server fields (empty — they never show w...
No secret has a literal fallback in code or config; the Janus API secret never goes to a browser
The Janus API, token and admin secrets and the TURN password were committed four times over: as @Value defaults in WebRTCController and JanusService, as default...
Securityservice never stores a password as typed
Two writers put plaintext into USERS.PASSWORD. Both called User.encodePassword(), which needs a static encoder that only initializerservice ever sets **********...
Retail store connections are reachable only by their own org's commerce settings managers
The retail provider-config handlers on CommerceMarketController resolved the session's org and then used whatever market and config uid the path named. Update, ...
A Canva connect only returns the browser to the org's own console
POST /api/media/canva/connect-start stored whatever returnUrl the body named, and the OAuth callback on the API host redirects to it after Canva's consent scree...
The System User acts only inside the organization it was entered into
There is one System User for the whole platform. Platform operators, and support staff holding a grant scoped to a single ticket's organization, enter a tenant ...
Send the typed address with the reset code, and forward the caller's address
The reset page sent the 8-character code from the letter on its own, and SecurityService checked it against every account's outstanding reset at once, with no c...
A shared mailbox's access list is only readable inside its own organization
GET **************** called **************** which read the access rows for any mailbox id. Every other access operation (update, delete, grant, revoke) loads t...
Play the kamo14 reel, and let it be paused
The recut reel (new closing logo shot, otherwise frame-identical, same 66s running time and chapter timings) is published under its own name. The kamo13 ladder ...
Encode the kamo14 reel
The marketing reel was recut (new closing logo shot) and uploaded as public/kamo14.mp4. It gets a new name instead of replacing kamo13 in place because the ladd...
Windows that do not fit the dock stand in rows behind it
A tool window that does not fit the front row now stands in a row BEHIND it, one title strip higher per row: its 42px title bar and 10px of body show above the ...
Only an org's owner, its CONFIGURE_SYSTEM members or active god mode can change its settings
PUT /api/security/org/{id} took no request at all. ResourceServerConfig permits every request and APIService relays /api/security/**, so one anonymous request c...
An OAuth app save keeps its client secret unless a new one is typed; owners' credentials stay out of org JSON
PUT /api/oauth-config/{id} stored whatever arrived under clientSecret. Responses mask the secret, and the edit form sends a blank back while promising "Leave bl...
A shared mailbox response carries no IMAP login
GET /api/email/shared-mailboxes (and /my-access, create, update) return SharedMailboxEntity itself to any session in the organization. Until the library's crede...
The provider form never holds the stored API key
AIService no longer returns provider API keys (only hasApiKey and a last-four mask). The edit button used to copy the returned key into the form, so it was in t...
Provider API keys never leave AIService, and only MANAGE_AI_SETTINGS can change a provider
GET /api/ai/providers and GET /api/ai/providers/{id} answered with each provider's DECRYPTED API key. The list is what every member's AI chat model picker loads...
Keep every credential field out of JSON, and guard the rule library-wide
Follow-up to 034378d2, which covered the columns NAMED as ciphertext. Read-only audits of origin/main in every repository found 61 more fields holding credentia...
Overlays clear the tool windows, scrollbars stack with their layer, and the rest of the shell geometry
What was left after pages stopped painting over the shell. Overlays opened BEHIND tool windows. Hand-rolled modals, menus and toasts named levels inside the sh...
Start a Facebook / Instagram connection through the authenticated connect-start
The Connect button navigated to **************** MediaService trusted both values with no session, so anyone who knew a connection id could bind their own page ...
Only an authorized member can connect a Facebook or Instagram page, and only back to their own console
The Meta connect flow trusted its URL. GET **************** took connectionId and returnUrl from the query string with no session, and state was unsigned base64...
Refuse webhook posts for Discord connections, which only ever receive DMs over the Gateway
Discord DMs reach MediaService only through DiscordGatewayManager's WebSocket, which publishes straight to social.inbound.raw. But every social connection has a...
Pages stay under the nav, the Interaction Center and the tool windows
The same two mistakes as /calendar's, everywhere else they were made. AuthedChrome's content box names no z-index, so a z-index in page code is a level in the R...
Seven link sets that match the nav, and careers goes to the careers site
The footer now lists Features, Services, Pricing, Company, Resources, Solutions and Legal, in that order. That is the top nav's own five categories plus the two...
A person taken out of a drip stays out
The engine moves on up to 200 due people per drip from copies it read at the start of a pass, up to 25 seconds old by the time each is used. Meanwhile a member ...
The drip enroll dialog finds leads by email
The lead search behind it now matches a lead's email (kamo-shared-library 992569a6, live with SecurityService 5c7319a), so the dialog says so: name, email, comp...
A search term reads the lead's email
Walks the grid specification's LIKE branches on the Hibernate this service runs (the HQL rendering leaves function arguments out, so it cannot show which column...
A lead search matches the lead's email too
The /leads grid's boxes and the drip enroll dialog send what was typed as search terms, OR-ed across the lead's names, company, vendor lead id and number. The e...
The calendar stays under the nav and the tool windows
/calendar positioned itself over the viewport — fixed at 56/80 with z-index 1000 — instead of filling the content box AuthedChrome gives every page. That box na...
Keep every ciphertext column out of JSON, and guard the rule library-wide
Follow-up to 096feaa1 (Organization's GoDaddy credentials were being served by an endpoint that needs no session). A scan of every **************** found fourte...
Stop GET /org/{id} shipping the GoDaddy credentials, and lock it to this service's mapper
The fix is in kamo-shared-library 096feaa1: Organization.godaddyApiKey and godaddyApiSecret are now @JsonIgnore. That change reaches production only when a serv...
Never serialize the GoDaddy key and secret ciphertext
GET /api/security/org/{id} (and /org/domain/{host}) returns the Organization entity itself and answers without a session, and that body carried godaddyApiKey an...
Drip campaigns on /marketing/email — triggers, a visual builder, people and performance
/marketing/email gets a Broadcasts / Drips switch (?view=drips). The drips view lists every drip as a card with its trigger, its sequence and live counts, KPI a...
An unconfigured build stops asking SecurityService for org ""
getHuntOffer fetched the promotion status even with no hunt configuration, so that the attempt would tag every prerendered page site-hunt. With no HUNT_ORG_ID t...
People in a paused drip still leave it when their lead moves on
A paused drip's exit rules (status change, reassignment, goal click) are now listened for, so resuming it never sends to someone who should have left while it w...
Every page shows how many times it has been viewed
A view counter now sits at the foot of every page, in the footer's bottom row beside Sitemap and Back to top: an eye whose iris is the site's hexagon, and the f...
Count the marketing site's page views, on the article or on the page
KBService now answers the view counter kamo-marketing shows at the foot of every page. Two endpoints, both {"views": n} with the view just counted included: ...
A drip's People counts follow the search, so All is always the sum of its chips
Page-view counters for the marketing site
Two tables behind the view count kamo-marketing now shows at the foot of every page, written by KBService's /internal/page-views endpoints. KbArticleView (KB_A...
The Lifestyle Logo, a fourth logo per brand and the default background watermark
Behavior & Labeling gains a Lifestyle Logo slot beside the full logo, the simple logo and the tab icon, in both the company and the software (white-label) rows....
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.