Signing in was rebuilt from the ground up

Authorisation was rebuilt around sliding tokens and real sessions. In practice the change people notice is that they stop being signed out: a session that is being used extends itself, so the app stops asking for a password every few days for no reason a user could perceive.

Underneath it is a larger change. There are now roles, ownership checks on the operations that modify something, and a session record per device that can be looked at and ended. Before this, a number of endpoints established who you were and then did not check whether the thing you were editing was yours.

Two security faults were closed in the same pass, and both are worth stating plainly rather than describing as hardening. Contributor endpoints had been returning the stored password hash, refresh tokens and the email verification code in their responses — fields that should never leave the server, handed to anybody who asked for a profile. And the password-reset flow echoed the reset code back in its own response, which means the code protecting an account was available to whoever triggered the reset rather than only to the person holding the mailbox.

Existing sign-ins were carried across rather than dropped. A separate endpoint upgrades an old session to the new scheme on first use, so the rebuild did not sign out everybody who already had the app.