We keep hunting the plugin, Hub dashboard, and customer API. 2.1.175 refuses a hash_check restore that extracts files unless the archive still lists file hashes. Extra Show stays passwordless. 2.1.174 refuses a bound restore when extracted files are not in the listed hashes. Extra Show stays passwordless. 2.1.173 refuses a hash_check restore that lists a SQL dump unless db.sha256 still stays. Extra Show stays passwordless. 2.1.172 checks listed db size on a bound restore even without db.sha256. Extra Show stays passwordless. 2.1.171 refuses a bound restore that lists db.sha256 unless hash_check still stays. Extra Show stays passwordless. 2.1.170 refuses a 2.1.114 bind when the archive lists file hashes the bind does not cover. Extra Show stays passwordless. 2.1.169 checks listed file hashes on a bound restore even without hash_check. Extra Show stays passwordless. 2.1.168 refuses a restore archive that names this Site ID unless its bind still verifies. Extra Show stays passwordless. 2.1.167 puts a Hub operator password rotate on the eight-try operator password burst before the Hub operator password. Extra Show stays passwordless. 2.1.166 puts a Hub operator Extra enable or disconnect on the eight-try operator billing burst before the Hub operator password. Extra Show stays passwordless. 2.1.165 puts Extra enable or disconnect on the eight-try Extra burst before the Hub password. Extra Show stays passwordless. 2.1.164 puts saving or removing bucket keys on an eight-try bucket burst. Extra Show stays passwordless. 2.1.163 puts a Cloudflare token save or disconnect on an eight-try Cloud token burst. Extra Show stays passwordless. 2.1.162 puts a Site key rotate on an eight-try rotate burst. Extra Show stays passwordless. 2.1.161 puts a Site disconnect on an eight-try disconnect burst. Extra Show stays passwordless. 2.1.160 puts signing out one device, other devices, or all devices on an eight-try session burst. Extra Show stays passwordless. 2.1.159 puts a Hub two-factor start, finish, or disable on an eight-try two-factor burst. Extra Show stays passwordless. 2.1.158 puts a plan cancel, resume, switch, or close on an eight-try plan burst. Extra Show stays passwordless. 2.1.157 puts Remove selected sites on the eight-try seat burst. Extra Show stays passwordless. 2.1.156 puts Buy more seats on an eight-try seat burst. Extra Show stays passwordless. 2.1.155 puts GET Cloud bound-zone ruleset refresh on an eight-try Cloud ruleset burst. Extra Show stays passwordless. 2.1.154 lists a Hub Extra refresh from Hub support under Account activity. Extra Show stays passwordless. 2.1.153 lists a Hub Extra enable or disconnect from Hub support under Account activity. Extra Show stays passwordless. 2.1.152 puts a Hub virtual-patch validate on the eight-try virtual-patch burst. Extra Show stays passwordless. 2.1.151 puts a Hub operator password rotate on the eight-try operator password burst. Extra Show stays passwordless. 2.1.150 puts a Hub Extra enable or disconnect on the eight-try Extra burst. Extra Show stays passwordless. 2.1.149 puts a Hub operator billing portal or export on an eight-try operator billing burst. Extra Show stays passwordless. 2.1.148 puts a Hub site rotate or license override on an eight-try operator console burst. Extra Show stays passwordless. 2.1.147 puts a Hub Care claim, start, or complete on an eight-try Care queue burst. Extra Show stays passwordless. 2.1.146 puts a Hub virtual-patch stage, publish, or rollback on an eight-try virtual-patch burst. Extra Show stays passwordless. 2.1.145 puts a Hub support connect or reset email on an eight-try support burst. Extra Show stays passwordless. 2.1.144 treats Extra as available when Extra is configured. Extra Show stays passwordless. 2.1.143 lists a Shield Care cleanup fee under Account activity. Extra Show stays passwordless. 2.1.142 lists a sites, activity, billing, or Care handoff CSV downloaded from Hub support under Account activity. Extra Show stays passwordless. 2.1.141 lists a site suspend, complimentary Pro, or override clear from Hub support under Account activity. Extra Show stays passwordless. 2.1.140 lists a connect or sign-in email from Hub support under Account activity. Extra Show stays passwordless. 2.1.139 lists a Site key rotate, restore, or revoke from Hub support under Account activity. Extra Show stays passwordless. 2.1.138 lists a password reset email under Account activity. Requesting a password reset stays a click. Site keys revoked after a password or 2FA change are listed under Account activity. Extra Show stays passwordless. 2.1.137 lists a Care follow-up note or site details save under Account activity. Saving a Care follow-up note or site details stays a click and refuses a ninth try in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.136 lists a Care WordPress access save or revoke under Account activity. Saving or removing Care WordPress access stays a click and refuses a ninth try in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.135 lists a weekly summary or setup reminder change under Account activity. Saving email preferences stays a click and refuses a ninth try in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.134 lists a Hub sign-in lockout under Account activity. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.133 lists a site label save under Account activity. Saving a site label stays a click and refuses a ninth try in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.132 lists a billing portal open under Account activity. Opening Manage billing stays a click and refuses a ninth try in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.131 lists a sites, activity, billing, or Care handoff CSV under Account activity. Export downloads stay a click and refuse a ninth try in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.130 puts Protect settings save, guided lockdown, admin two-factor, virtual-patch raise, and login tighten on the same eight-try Protect burst. Protect settings save stays a click and refuses a ninth try in 15 minutes. Guided lockdown, admin two-factor, virtual-patch raise, and login tighten stay a click and share the Protect burst. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.129 puts Watch alert settings on the same eight-try Watch burst. Watch alert settings stay a click and refuse a ninth try in 15 minutes. A restore preview is listed under Account activity. Preview restore stays a click and refuses a ninth try in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.128 lists a Watch URL save, a Watch check, a Watch test, and Watch alert settings under Account activity. Watch URL, Check now, and Send test stay a click and refuse a ninth try in 15 minutes. A backup download stays a click and refuses a ninth try in 15 minutes. Setup reminder changes are listed under Account activity. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.127 lists a Copy now or restore under Account activity. Copy now and restore stay a click and refuse a ninth try in 15 minutes. Turning Extra protection on or off is listed under Account activity. A Site disconnect is listed under Account activity. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.126 lists a backup download under Account activity. Saving or removing bucket keys is listed under Account activity and still needs your Hub password. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.125 lists a Cloudflare token Show and a bucket key Show under Account activity. Show still needs your Hub password. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.124: The Cloud dashboard no longer lists token zones on a refresh. Load zones stays a click, is listed under Account activity, and refuses a ninth list in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.123 lists a Cloudflare zone list under Account activity and refuses a ninth list in 15 minutes. Listing zones stays a click. The CNAME stub stays a click, is listed under Account activity, and refuses a ninth save or check in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.122 asks for the Hub password before saving a Cloudflare zone, lists that write under Account activity, and shares the eight-try Cloud firewall burst. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.121 asks for the Hub password before turning Cloud firewall on or off, or disconnecting one site, lists those writes under Account activity, and refuses a ninth change in 15 minutes. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.120 asks for the Hub password before saving or disconnecting a Cloudflare token, and lists those writes under Account activity. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.119 refuses Extra protection Refresh after eight tries in 15 minutes, lists a refresh under Account activity, and asks for the Hub password before saving or removing bucket keys. Extra Show stays passwordless. Care operator reveal stays passwordless. Site key Show stays passwordless. 2.1.118 refuses restore when a hash_check or db.sha256 archive names a Site ID but the bind was stripped, and remasks Site key, Extra, Care, and bucket fields before print. Care operator reveal stays passwordless. Site key Show stays passwordless. Extra Show stays passwordless. 2.1.117 binds hash_check and db.sha256 on new linked backups so stripping those markers is refused (a 2.1.116 file-inventory bind, a 2.1.115 file-inventory bind, a 2.1.114 created-time bind, and a 2.1.113 Site ID bind still verify). Care operator reveal stays passwordless. Site key Show stays passwordless. Extra Show stays passwordless. 2.1.116 lists a Care WordPress access reveal under Account activity, and restore refuses extracted files or SQL that do not match a listed sha256 on a 2.1.116 archive (archives without those hashes or hash_check still restore). Care operator reveal stays passwordless. Site key Show stays passwordless. Extra Show stays passwordless. 2.1.115 lists Extra Show under Account activity, binds new backups to Site ID plus created time plus file inventory (older bind still verifies), requires X-Bedrock-Package-Sha256 when this Hub sends X-Bedrock-Package-Sha256-Required or when this plugin already saw that Hub send a zip SHA256, and does not follow Hub zip redirects. Care operator reveal stays passwordless. Site key Show stays passwordless. Extra Show stays passwordless. 2.1.114 asks for the Hub password before signing out one device, shows signed-in time on the session list, fail-closes Extra Show burst, binds new backups to Site ID plus created time (old bind still verifies), and consumes X-Bedrock-Package-Sha256 on a Hub-served plugin update. Care operator reveal stays passwordless. Site key Show stays passwordless. Extra Show stays passwordless. 2.1.113 asks for the Hub password before Sign out all devices or Sign out other devices even when 2FA is off, remasks a Care operator reveal after 15 seconds with a burst limit and print hide, writes an HMAC bind on new linked backups so a tampered bind is refused, keeps offline Pro extras only when the last heartbeat was still live, and sends X-Bedrock-Package-Sha256 on the Hub plugin zip. Care operator reveal stays passwordless. Site key Show stays passwordless. Extra Show stays passwordless. 2.1.112 hides a revealed Site key or extra protection key after 15 seconds, remasks Extra and bucket keys when you leave the tab, writes Extra Show to the customer activity log, asks the Hub operator password before Extra enable or disconnect, keeps offline Pro extras only when the last token was active, and pins this plugin's update zip to wordpress.org, a local file, or the connected Hub. Site key Show stays passwordless. 2.1.111 asks for the Hub password (and 2FA when enrolled) before Extra protection turn on or turn off, hides WordPress username and login URL from public Care status, fail-closes every rate bucket when SQLite is busy, and writes this Site ID into a new backup so restore refuses a mismatch. Site key Show stays passwordless. 2.1.110 rolls a failed Connect back so a wrong Site key cannot leave the site Linked or turn Pro extras off, wipes leftover Site key ciphertext on Disconnect, refuses Extra protection disconnect on a closed account, and strips path characters from a vendor site id. Site key Show stays passwordless. 2.1.109 keeps Extra protection in Bedrock Shield language on the customer Hub, help, and plugin zip. Site key Show stays passwordless. 2.1.108 added optional extra protection on the Hub for paid Pro and Shield Care sites that opt in. Site key Show stays passwordless. 2.1.107 is a marketing visual pass: Plus Jakarta Sans stays, marketing brand colors stay, cited Sucuri and Wordfence numbers stay, home uses a two-column hero and numbered Connect Protect Restore cards, Pro is the taller recommended middle card, Basic stays $15 / month, cleanup stays $99 once, and Checkout still collects email. Site key Show stays passwordless. 2.1.106 is a marketing home and pricing restyle: Plus Jakarta Sans stays, marketing brand colors stay, cited Sucuri and Wordfence numbers stay, Connect Protect Restore is the setup path, Basic stays $15 / month, cleanup stays $99 once, and Checkout still collects email. Site key Show stays passwordless. 2.1.105 is Care cleanup access: after a $99 pay the ticket waits on WordPress login (URL, username, password, or a temp admin invite), hosting login is optional, credentials stay sealed, operators reveal with a passwordless Show, work cannot start without WordPress access, a closed account cannot submit, Care create still takes the same six-ticket floor, and Site key Show stays passwordless. 2.1.104 is a continued deep pass: subscriber REST privilege routes stay blocked even when a storefront user is logged in, X-Forwarded-Proto is honored only behind a trusted hop, plugin download sends Cache-Control private no-store, leftover dump files stay off the Hub router, and Site key Show stays passwordless. 2.1.103 is a Wordfence-driven attacker-block layer: header traversal is blocked, unauth REST privilege routes are blocked, unauth admin-ajax POST is scanned, template LFI and null-byte args are blocked, backup store writes web.config deny, upload refuses PHP content-types, the dashboard flags most-targeted plugin slugs that are present, there is no live CVE feed without an API key, and Site key Show stays passwordless. 2.1.102 is a continued deep pass: Composer production stays empty, Watch refuses 0.0.0.0 and mapped loopback, plugin scan history stays autoload=no, Hub prune keeps twenty live sessions, reset tokens leave the query string, Connect Hub errors stay escaped, Stripe portal return stays pinned, non-auth rate buckets still fail-open if SQLite is busy, Connect refuses a Hub URL with userinfo, Care operator list has no OFFSET page, and Site key Show stays passwordless. 2.1.101 is a continued deep pass: operator LIKE still escapes stored nicknames, there is no operator sample import leftover, plugin Location stays wp_safe_redirect, 2FA backup consume stays compare-and-swap with no regenerate wipe leftover, backup download stays path-only with same-origin Referrer-Policy, integrity hashes use a literal algorithm not an option, CSV export still prefixes classic equals-cmd pipe formulas, mu-plugin drop still checks is_writable, billing_events stay after close so Stripe event ids stay unique, and Site key Show stays passwordless. 2.1.100 is a continued deep pass: HTTPS redirects pin to app_url when it is set, dual Transfer-Encoding plus Content-Length is refused, post-login return stays customer.php, account upsert writes a known column set, mail bodies are PHP templates not SSTI, there is no GraphQL leftover, outbound TLS verifies but does not pin a certificate, there is no nopriv AJAX leftover, the plugin does not filter cron_schedules, first activate still snapshots the must-use baseline from disk, and Site key Show stays passwordless. 2.1.99 is a continued deep pass: Hub has no unserialize, help articles are an in-memory map not a user-supplied include path, CSRF still requires the session token when Origin and Referer are both missing, Stripe webhook verifies the signature before decode and enqueue, there is no account merge or transfer leftover, the router refuses phpinfo leftovers, Site IDs retry on UNIQUE collision, job enqueue stays on an allowlist with a 256 KB JSON cap, mutating plugin AJAX stays logged-in admin with no nopriv hook, restore still trusts a backup this site created, and Site key Show stays passwordless. 2.1.98 is a continued deep pass: Hub SQLite backup re-restricts dest and source WAL and journal sidecars after VACUUM or copy so a umask 0022 snapshot cannot leave world-readable sidecars, operator sessions call the same lockdown as customer sessions before start, rate buckets use server time() and ignore a forged Date header, ingest nonce uniqueness survives VACUUM INTO because it is a dest snapshot not a live rebuild, operator notes stay text with no attachment sink, there is no marketing contact form, plugin firewall first-hit wins so a later allow cannot bypass a deny, Protected score stays local firewall lockouts scan and clean and ignores handshake features, update host pin runs on upgrader_pre_download before the package bytes, and Site key Show stays passwordless. 2.1.97 is a continued deep pass: Hub 2FA enroll stays compare-and-swap so two overlapping starts cannot mint two enabled secrets, Hub session cookies stay path=/ and host-only, plugin license ciphertext stays autoload=no, Watch fetches still pin CURLOPT_RESOLVE so DNS cannot rebind after the allowlist, pack download version is an integer not a filesystem path, the plugin activity log table escapes every column, seat add uses Hub subscription quantity plus a 1-to-20 cap not a client-supplied new total, operator login stays IP plus user plus 2FA bucketed, plugin Disconnect stays a local unlink, Care status tokens stay 32-hex with a lookup floor, and Site key Show stays passwordless. 2.1.96 is a continued deep pass: Care ticket create from the backup page or plugin HMAC takes the same cleanup_create floor as the Care form so a stolen session cannot open more than six tickets in 15 minutes, operator password rotate uses the same 12-to-128 window as a customer so an overlong string cannot hang Argon2id, customer TOTP consume already stays compare-and-swap, Hub absolute session lifetime still uses login time not last-seen so activity cannot extend the 12 hour cap, plugin settings stay off REST so a subscriber cannot read a Site key, backup download tokens stay HMAC-SHA256 not a guessable id, plugin scan queue still needs manage_options and a nonce, checkout success stays on the Hub connect or login path, login and reset still share generic copy, Unban-my-IP still needs a POST nonce, and Site key Show stays passwordless. 2.1.95 is a continued deep pass: login flood takes the same dummy-hash floor as reset so a guessed password cannot be timed against a lockout, operator TOTP consume is compare-and-swap so a reused window code cannot grant twice, setup-mail URLs refuse a plain HTTP origin unless this is a loopback preview, quarantine list stays this blog option, there is no operator export of api_key, Stripe event ids are not purged, firewall blocklist keys the client IP not Host, Hub jobs do not steal a running row, Connect success stays on wp-admin, Care operator updates after done still write an audit row, and Site key Show stays passwordless. 2.1.94 is a continued deep pass: operator restore and Show mint refuse a closed tombstone so Connect cannot look restored while the Site key stays dead, handshake suspends a closed account even if a registry row was reminted, mail From strips CR/LF and angle brackets from the display name, login still regenerates the session id before auth flags, Watch fingerprints still include account_id, the local backup key is still a random hex option not a passphrase, there is no IP ban list import, JSON errors still stay slugs, CORS still never echoes Origin, pack signature checks do not skip when WP_DEBUG is on, Care credit stays a derived count without a Stripe refund id uniqueness requirement, and Site key Show stays passwordless. 2.1.93 is a continued deep pass: account close claims the tombstone before Site keys are revoked so a concurrent restore cannot leave a live key on a closed row, Hub SQLite snapshots refuse a symlink dest, Care public status sends Cache-Control private no-store, there is still no operator impersonation cookie, plugin outbound HTTPS still forces TLS verify, X-Forwarded-For is still ignored unless a load-test trust header matches on a preview Hub, there is no firewall rule import that parses YAML or PHP objects, Stripe webhook auth stays the HMAC secret not a guessable path, Connect still needs a wp-admin nonce, paid checkout apply still takes BEGIN IMMEDIATE plus a unique session id, closed-account Hub jobs still skip, and Site key Show stays passwordless. 2.1.92 is a continued deep pass: closed-account Hub jobs are skipped so a tombstone cannot keep receiving scheduled backups or Watch mail, there is no remember-me cookie, Hub email stays Stripe-only, Connect still refuses metadata and private hub_url targets, pack apply still refuses a downgrade after a re-read, the plugin logger stays table-only, 2FA backup codes are not printed in an HTML comment, Stripe API sends no Idempotency-Key, scan pause and resume still need manage_options and a nonce, setup mail has no continue URL, billing portal session create still takes the Stripe account lock, SameSite=None cookies without Secure still fall back to Strict, site nicknames still refuse URL, punycode, and C0 control characters, and Site key Show stays passwordless. 2.1.91 is a continued deep pass: billing portal session create takes the Stripe account lock, SameSite=None cookies without Secure fall back to Strict, site nicknames refuse URL, punycode, and C0 control characters, scan finding paths stay escaped, operator notes stay escaped, a revoked Site key still gets a signed suspend, Care has no file-upload sink, uninstall still deletes the Site key ciphertext option, robots.txt names no sitemap, and Site key Show stays passwordless. 2.1.90 is a continued deep pass: CSV export treats NBSP, zero-width, and fullwidth formula leads as formulas, public health drops the PHP version, quarantine restore refuses wp-config and other protected basenames even when the dest is missing, plan change takes the Stripe account lock so a mid-checkout seat add cannot be overwritten, there is no leftover Hub OAuth state cookie, plugin backup download does not send Content-Disposition, Watch webhook rotate still does not fetch the destination, Care credit stays a derived count so a double refund cannot mint two credits, Site key paste still does not land in debug.log, mail preview still needs an operator, and Site key Show stays passwordless. 2.1.89 is a continued deep pass: Stripe webhook signatures refuse an empty body even when the HMAC matches, Hub IP rate buckets fold IPv6 to /64 so a shared prefix cannot spray, tenant extras never fold so two accounts cannot share one bucket, ingest and Stripe webhook keys use that fold, a customer password change still kills sibling Hub sessions, Hub 2FA disable still needs the password, Site key restore stays compare-and-swap, Care public status stays a 32-hex token, restore archive members still refuse parent paths, quarantine delete still needs a POST nonce, and Site key Show stays passwordless. 2.1.88 is a continued deep pass: operator password rotate kills other Hub operator sessions, ingest and handshake timestamps use an exclusive skew window, nonce replay TTL is longer than twice that window, mass site delete takes the Stripe account lock, setup tokens cannot be looked up after a password exists, Care notes stay escaped text, billing portal return stays pinned to app_url, SQLite backup filenames still refuse ATTACH, a fresh plugin handshake token with fewer features wins after a plan drop, and Site key Show stays passwordless. 2.1.87 is a continued deep pass: a Care cleanup token cannot rewrite intake after refunded or after done outside the 14-day follow-up (follow-up is notes-only), closed accounts cannot export, mutating plugin scan AJAX refuses GET, backup-code consume drops exactly one hash, password-reset rate deny takes the same timing pad as a real request, notification prefs stay session or HMAC scoped, login still regenerates the session id, changing the Hub password still revokes every Site key, Site IDs stay, Show or operator restore still mints a new secret, download tokens still HMAC the session user-agent when one is stored, leftover non-ASCII after an update-host fold is still refused, and Site key Show stays passwordless. 2.1.86 is a continued deep pass: changing the Hub password or turning on two-factor revokes every Site key on that account, Site IDs stay, Show or operator restore mints a new secret, download tokens HMAC the session user-agent when one is stored, leftover non-ASCII after an update-host fold is refused, mass-assign strip drops TOTP and reset leftovers, license upsert still cannot clobber a live handshake, two Stripe jobs for one account still take a Hub-side lock, Watch webhook rotate stays compare-and-swap, Hub rate buckets still fold IPv6, Hub cookies stay host-only, and Site key Show stays passwordless. 2.1.85 is a continued deep pass: license upsert cannot clobber a live handshake, two Stripe jobs for one account take a Hub-side lock, Watch webhook rotate is compare-and-swap, Hub rate buckets fold IPv6 compression and strip zone ids, Hub cookies stay host-only, cleanup Stripe session ids stay cs_, plugin update-host checks fold a trailing dot and punycode, shared-browser leftover cookies still cannot retarget another account, a Hub session without a registry id still dies after a password change, restore jobs stay pinned to one Site ID, download tokens still need the matching session and user-agent, handshake timestamps still refuse the 2038 overflow, and Site key Show stays passwordless. 2.1.84 is a continued deep pass: leftover customer and operator cookies on a shared browser cannot silently retarget another account, a Hub session without a registry id dies after a password change, restore jobs stay pinned to one Site ID, download tokens need the matching session and user-agent, handshake timestamps refuse the 2038 32-bit overflow, rate windows stay unix/UTC, Hub lib stays free of unserialize and eval leftovers, and Site key Show stays passwordless. 2.1.83 is a continued deep pass: the buyer zip stays free of tests, phpunit, .env, .git, hub-access, private keys, and agent-store paths, Composer require-dev stays pinned, Hub Docker ignore stays broad, sample configs cannot carry live secrets, debug leftover pages need an operator session, source maps stay off the static serve, and Site key Show stays passwordless. 2.1.82 is a continued deep pass: ingest JSON stays width-capped, nested gzip is refused, parse_str cannot bypass max_input_vars, log lines and Location values cannot carry CR/LF, job enqueue stays on an allowlist with a payload cap, Hub SQLite backup closes the snapshot handle, pack JSON stays size-capped, a scan lock older than 15 minutes is stolen, and Site key Show stays passwordless. 2.1.81 is a continued deep pass: Hub 2FA enroll is compare-and-swap so a stale confirm cannot overwrite an enabled secret, closed accounts stay closed on upsert, a live email cannot move onto another account, tenant rate buckets refuse an empty extra, Hub SQLite snapshots stay under backups/hub-*.sqlite, export filenames stay path-only, Care ticket ids stay cln_ plus 12 hex, Stripe does not push Hub email changes, Hub entitlement cannot carry a WordPress role, and Site key Show stays passwordless. 2.1.80 is a continued deep pass: Cloudflare zone updates take a Hub-side lock so GET-then-PUT cannot interleave, weekly digest unsubscribe tokens expire after seven days, CSV formula prefixes survive a leading space or BOM, customer.js copies own keys only, clipboard fallback textareas turn autocomplete off, print CSS hides revealed Site keys, CSP blocks object and worker sources, and Site key Show stays passwordless. 2.1.79 still claims billing jobs before Watch and backup floods, refuses an older signed pack after a newer write, makes first-operator config create exclusive, drops last24 and job counts from public health, refuses overflow handshake timestamps, allowlists Watch fingerprint extras, refuses S3 versionId keys, and keeps leftover sitemap and metrics paths off the Hub static serve. 2.1.79 is a continued deep pass: billing jobs claim before Watch and backup floods, an older signed pack cannot overwrite a newer stored version, first-operator config create is exclusive, public health drops last24 and job counts, handshake timestamps refuse leading zeros and overflow digit strings, Watch fingerprint extras stay on an allowlist, S3 object keys cannot carry a versionId, leftover sitemap and metrics paths stay off the Hub static serve, and Site key Show stays passwordless. 2.1.78 still flips Hub licenses when Stripe already shows canceled, treats an empty signed-pack key_id as unknown, refuses a short disposable-domain list on first claim, and writes the live backup key back on every restore fail path. Site key Show stays passwordless. 2.1.77 still collapses NFKC and plus-aliases so one mailbox cannot open two accounts, Stripe-mapped Price IDs stay a paid total instead of adding seats on top of a webhook that already ran, HMAC signatures refuse none/md5/sha1 prefixes, leftover bcrypt customer hashes refuse a password longer than 72 bytes, and Site key Show stays passwordless. 2.1.76 still pins Watch and webhook fetches so DNS cannot rebind after resolve, Hub to S3 and Stripe set SSL_VERIFYHOST, dual Transfer-Encoding and Content-Length is refused, and the Hub router decodes encoded dots then keeps static files inside the Hub root. 2.1.75 still escapes operator LIKE wildcards, refuses checkout GET field pollution and JSON bodies, refuses a conflicting Connect GET/POST token, and refuses a mixed JSON/form Content-Type. 2.1.74 still prefers X-Bedrock-Cron and strips a query key from REQUEST_URI and Activity, keeps license ciphertext and the alert webhook secret off autoload, uninstalls those split options, and wipes sealed S3 and Cloudflare tokens on close. Stripe test and live events cannot mix. Session cookies stay host-only. 2.1.73 still claims one email on first checkout, treats invoice.paid without a stored paid checkout as a no-op, requires a 16+ character cron secret, prunes throttle rows, and scrubs exception logs. 2.1.72 still takes a timing floor and a dummy Argon2 so a mailbox cannot prove an email, the reset token is stashed and stripped from the query string, and the reset page sends Referrer-Policy no-referrer. Hub Referrer-Policy stays same-origin so Chrome form posts keep the session cookie. 2.1.71 still skips closed Stripe customers and refuses an ingest site_url another Site ID already holds. 2.1.70 still caps gzip archives at 32 MB, folds handshake site_url case and trailing-dot hosts, refuses .env and parent traversal on the Hub router, clips Watch alert context, and requires a 16-byte AES-GCM tag. 2.1.69 still caps passwords at 128 characters, unwraps IPv4-mapped IPv6, drops userinfo and homoglyph hosts, and pins a restore so prune cannot delete it. Hub scripts carry sha384 integrity. Slack and webhook sends re-check the public URL. Custom S3 hosts cannot resolve to a blocked IP. 2.1.68 still blocks revoked ingest, prefixes spreadsheet formulas, claims quarantine inodes, retries Site IDs, denies CORS preflight, forces outbound TLS, and mints a new key on re-activate. 2.1.67 still makes plan change and account close one-winner. 2.1.66 still checks Origin or Referer and keeps download tokens one-use. 2.1.65 still makes reset and prune one-winner. 2.1.64 still makes rotate and restore one-winner. 2.1.63 still sets Connect password once and follows Price IDs. 2.1.62 still adds idle and absolute Hub session lifetime. Bucket keys and Cloudflare tokens need your Hub password to Show, and 2FA when enrolled. Site key Show stays passwordless and rate limited.

A stolen Hub session can still click Site key Show until you sign out other sessions. Download links for locked copies also need that session and are one-use. This is not unhackable.

We never email a Site key or a bucket secret. You never change DNS.

Keep Site keys from being guessed or Always keep 1 safe copy off your host.