Version 0.84.1

A device that had already opened your drive can no longer replace your file names and folders with a placeholder list.

NMTS keeps your file names and folder structure in an encrypted list that only your browser can open; the server holds those bytes and cannot read them. If the server answered that there is no such list — after a restore from an old snapshot, or because a row went missing — the browser threw away the good list it had just opened from its own storage and built a new one out of what the server does know, which is every file at one level with a placeholder name, and that replaced the real list without asking. The rebuilt list also started again at version 1, so the next time the browser opened it, it refused its own list as a rollback and the device could no longer write anything at all. The browser now treats that answer the same way it treats a rollback: it stops and asks if it has seen a list before, which detects an old list rather than preventing one.

Another account's upload retry key can no longer pay for your credits.

Every upload carries a short retry key so that sending the same upload twice is charged once. The check that asked whether this key had already been charged did not ask whose account it belonged to, so an account sending a key that belonged to somebody else was told the charge had already happened, handed that other account’s record back, and paid nothing — while storage was still reserved on NMTS’s side. The check now looks only within the caller’s own credits. Nobody that NMTS can find was affected: the keys are random values that do not collide by accident, and the ledger holds no key that appears under two accounts.

Renewing a session's human check now requires a session first.

While you stay signed in, the browser quietly renews the human check behind your session, and that renewal spends a call to the outside verifier which NMTS pays for. The route said in its own first line that it authenticated before spending one; it did not — it read the authorization header without looking anything up, and the only session lookup on that path ran after the verifier had already answered. Anyone sending a made-up token could make NMTS pay for a verification, and it now refuses a token that names no live session before contacting the verifier. No account was affected: what was reachable was NMTS’s own verifier quota, which is also already bounded by the per-line request limit.