What changed
New
1. Service Accounts System New ServiceAccount model + database tables API endpoints for CRUD + key management Service account authentication (atgsa- prefix tokens) Per-service-account workspace permissions Database migrations + seeder support
2. Force Account Lockout & Security Exponential backoff lockout (max 24 hours) Lockout triggers: 6 failed login attempts (per email+IP) Admin unlock endpoint: POST /api/v1/security/lockouts/unlock Admin UI toggle: Settings > Security > Force Account Lockout Activity logging + security event tracking HTTP 423 (Locked) response with Retry-After header
3. Credential Expiry Notifications Temporary message system (temporary_credential_messages table) PAT token expiry detection + notifications Service account key expiry notifications /api/v1/credentials/expiry-notice endpoint Queued notification status tracking
4. Rate Limiting & Access Control Login rate limiting: 5/min per (email+IP), 20/min per IP Registration rate limiting: 5/min Force endpoint rate limiting: 6/min per IP Login lockout on failure threshold Configurable disable_email_registration setting
5. Kubernetes: A beta Helm chart in kubernetes/beta/ (app, gateway, mcp, MySQL and Redis StatefulSets, ingress, migration job, separate dev and prod values).
Improved
1. Plaintext Key Removal Before: System keys stored plaintext in validation_hash column After: Only SHA-256 hash + last-four digits retained Database leak no longer exposes all keys
2. Network Isolation Before: App port 8000 exposed to host (bypasses gateway) After: App internal-only, all traffic routes through gateway (8002/8443) Prevents direct app access, enforces rate limiting/security
3. Plaintext Token Hashing Before: PAT tokens stored plaintext in database After: Tokens hashed with SHA-256, last-four only visible Better compliance with credential storage standards
4. HTTPS Infrastructure Added gateway HTTPS port 8443 (ready for TLS termination) Sunset header points to docs (dynamic config-based) Production-ready certificate mounting support
5. Registration Security Before: API /auth/register ignored disable_email_registration setting After: Both web + API enforce the setting Consistent security policy across interfaces
Fixed
1. MCP (Model Context Protocol) Lifecycle Before: MCP profiles prevented controller access After: Controller fully manages start/stop via Docker API Operator can enable/disable from admin panel
2. Installation & Deployment Updated installers (bash + PowerShell) for port security Clarified: port 8000 = local-only, 8002 = expose to users Database password hardening (remove weak defaults) docker-compose.yml auto-downloads on upgrade