01 — UPDATES
What changed
Every line below resolves to a real commit or a real row in the task tracker. If there is no evidence behind it, it is not here.
2026 — AUGUST
- securityda1b666
The agent no longer believes who the caller says it is
The link between the website and the agent took the supplied user id at its word. It is now established server-side, so nobody can speak as somebody else.
- security5e6bb98
Error messages no longer leak the inside of the system
A failed request sometimes returned internal detail. That is replaced by a plain message, and two upload paths that had no limit are now rate-limited.
- securitye5d1387
Every data read is bound to your account
All reads now pass through one helper, plus a check that fails when new code skips it. A forgotten filter can no longer quietly show somebody else's data.
- security6093248 · SEC-3
The marketing site runs stricter in production
A setting only needed while developing was also on in production. It is off now, so the browser accepts fewer kinds of code on the page.
2026 — JUNE
- securityfcac83c
Forms no longer accept requests from other sites
Requests without a valid origin are now rejected rather than allowed through, and scheduled tasks validate their input first.
- securityc2bb7bf
Tokens are compared in a way that reveals nothing
Comparing secret tokens now always takes the same time, so the duration cannot reveal how much of a guess was right.
The code behind NORD lives in a private repository, so commit references are text rather than links.