Security work rarely makes for exciting release notes, but it matters. Here's the hardening we've shipped to keep your boards and your users' accounts protected. None of it needs any action from you.

🔒 Security

Microsoft SSO account protection: Closed a gap where a crafted email address could have been used to sign in as another user. Sign-in now verifies identity strictly against the provider's account identifier.
Hide post permissions: The "hide post" action is now enforced server-side for regular users, while admins and moderators keep full control.
Consent screen for connected apps: When an app connects to your Nolt account (for example an AI assistant through the MCP server), you now see a consent screen listing exactly what it's asking for before access is granted. Only pre-approved apps can start this flow.
Stricter search authorization: Search results are checked against your permissions on every request, so private posts and comments can't leak through search.
Bot protection on passwordless login: Email login and sign-up are now guarded by an invisible challenge. Real users won't notice it, automated abuse is dropped quietly, and if the challenge service is ever unavailable login still works. Boards on customer domains keep their existing rate limits instead.
Login code limits: Added a per-address cap on how many login codes can be requested in a short window.
Webhook hardening: Incoming email-event webhooks are signature-verified and rate-limited.

If you ever spot something that looks off, email hello@nolt.io and we'll jump on it.

Fixes: Security hardening