Live Change Log

The IoT tour needs no lineage: every Show Tour right is already on for every role (fefd98c2).

A3 PASS (live reply a model limit), A5, A8 (Lab 2 + step 5 in sp00verify), A10, A12, A13 PASS; A4 row from the Lab 2 lane's T6; A11 NOT PASSED on one criterion ...

Seeds the new SUSPICIOUS_SIGNIN_DETECTED canonical template, which SecurityService sends for a detection rule's NOTIFY_ADMIN_EMAIL response.

Picks up OrgStorageAggregator 3eda4b54: BULK_EXPORTS and EXCHANGE_DOCUMENTS read object_storage_days instead of 0.

SuspiciousDetectionService was injected into SecurityController and evaluate() was never called, so every rule an organization configured on the Security screen...

The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable...

ksemHasRight treated GD (god-mode ELIGIBILITY) as an all-rights bypass, so every god-eligible operator held every right on the 18 proxy routes that use it, with...

GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the ent...

SUSPICIOUS_SIGNIN_DETECTED joins the canonical templates. SecurityService's SuspiciousDetectionService sends it when a tenant-configured detection rule (failed-...

**************** held each member's access token, refresh token (Teams, RingCentral OAuth) and RingCentral JWT assertion exactly as the provider issued them. Ev...

God mode is SERVER-owned. The billing and LOS proxies copied the browser's X-God-Mode-Active onto the upstream call, and BillingService treated it plus users.is...

BillingService took X-God-Mode-Active plus users.is_god as god mode, and kamo-internal copied that header straight off the browser, so a god-eligible operator h...

state was base64 JSON {orgId, nonce, provider} built by the caller, the nonce was never stored or checked, and the sessionless callback trusted the decoded orgI...

The outbound webhook worker POSTed to whatever URL a subscriber stored, from inside the cluster, with no egress control - a subscription aimed at **************...

A form-encoded post (Twilio, Sinch, Vonage pointed at the wrong address) fell into readTree(), failed, and was answered 200, so the carrier never retried and th...

Seven @Value sites and application.yml fell back to the literal dev-secret-change-in-prod when **************** was missing, so a pod without its Secret sent a ...

OrgObjectStorageSweep writes BULK_EXPORTS and EXCHANGE_DOCUMENTS rows into object_storage_days, but OrgStorageAggregator only read that table for BRANDING and D...

Any member of an org could delete the org's public chat / integration keys: deleteKey checked only that the key belonged to the caller's org.

Connected-ecosystems design decided by the owner 2026-09-27: Kamo links the ecosystems an org already uses (official APIs only), per-function grants, consent-ba...

Branch Types (the security models child organizations are created under, with their default security roles, apps and home screens) was a tab on every organizati...

Branch types, the security models behind them (default security roles, app availability, home screens, commerce markets, subdomain config) and the master model ...

Branch types, and the security models behind them, move from every organization's Settings -> Account to Platform Administration -> Configuration. This is the p...

A1, A2, A7, A14 PASS; A6 PASS with an environment note; A9 FAIL -> fixed (mcpgatewayservice c44ce1f, ruling CP97-T5-1 in CP12 §7) -> PASS.

Saving a security model (e.g. its Default Security Roles) re-seeded and recalculated member rights for every org using the model before it responded. A model sh...

An SI's chat_find_or_create_dm refused by the interaction policy answered COLLAB_DENIED INTERACTION_POLICY but left its audit row's policy_decision and policy_r...

LeadAvailableEmailSweep (every 15 s, singleton lease) finds leads that entered the pool 2-15 minutes ago and are still unclaimed, per org via ix_leads_org_creat...

Adds the LEADS_AVAILABLE arm to sampleVariables, built through the same shared-lib LeadsAvailableEmail helper SecurityService sends with, so the admin preview s...

LEADS_AVAILABLE goes to everyone the accept-lead window offered a new lead to when it is still unclaimed two minutes later. It names the lead by last name and s...

They never had, for anybody. The trigger waited for userInfo.tokenId, which the type declares but the web app's /api/user-info never sends — so it returned befo...

An <img> reports load or error and nothing in between, so a request that never answered left an unsized element at 0x0 — a chat bubble with nothing in it. A mem...

The content-addressed key is <imgDatId>.<ext>, and every reader builds it from the attaching Img's own fileExt. Dedup matches on the bytes, so the same screensh...

The window opened at a fixed 560 while the row decided its height, so at the default 690 row the board was 346px square in a 540px column: 97px of empty table e...

WebKit (Safari, DuckDuckGo on macOS — the reporter's browser) only autoscrolls a text field toward the END of its text during a drag-select: dragging up out of ...