Version 0.86.1
2026-08-21 11:18:36 UTC
Security
1Four server-side rules that were written down but not actually standing are standing again.
None of these was leaking anything today: all four were places where what the server does and what its own notes say it does had drifted apart. (1) The rule saying a legal-deadline notice in a support thread carries no text was recorded as added three days ago but had never been installed on any database, because the name it used was already taken by an older rule; it is installed now under its own name, and no row was ever wrong. (2) Of the identifiers attached to a stored file part, the chain object id was the only one that becomes a key column and the only one with no shape check — it is checked now, and every part stored today already matched. (3) Printing the server’s configuration used to print four secrets with it, including the database password, and now prints names and no values at all; and (4) an error sentence from a service NMTS does not control could put a line NMTS never wrote into the log of the part that holds the storage funds, so those sentences are now flattened to one line and bounded.