An SI that sends a note with no level the internal default back changes nothing
CP97 Task 17's Luna compare found a live SI's own My Master Note, written before KamoCollab, carrying sensitivity MEMBER after one of her own appends in an AUDI...
An AUDIT org's SI is shown the record-link kinds every SI saw before KamoCollab
CP97 Task 17's Luna compare found her tools/list changed by KamoCollab: CP05 Task 7 appended TASK, DOCUMENT, KB_ARTICLE, MEMBER, AI_RUN and SMS_THREAD to Record...
Verify-password records a session re-check marker and limits wrong attempts
IoT SP01 Task 7 (marker half). KREAUTH<***Id> = member id for 3600 s after a correct password; five wrong passwords per session in 15 minutes answer 429 too_man...
Provider vocabulary, registry types 18-24 and the IoT callback path
Pin com.kamo.z.shared.iot in KamoInitializer's repository list
IoT SP01 Task 6. SP00 already added the entry; only the pin is new.
ReauthMarkers and **************** (delayed naks, exhausted callback)
IoT SP01 Task 5. The plan's test used AssertJ fail() without importing it; import added.
Reopening a field shows the settings just saved
The stack's sorted field list was memoized on each field's id and order only, so a change from Save Field (Display on Intake, title, required…) never rebuilt it...
SP00 adopted-deviation rows (master §10 D8-D12, KamoAI §11 D4) and the execution ledger (IoT SP00)
The eight IoT kinds — gated like EmailService with the owner rule, one order, their own marks (IoT SP00)
The /api/iot BFF route; a guard that every notification kind has its label and hint (IoT SP00)
IotRights.ts, the browser mirror of IotRights, parity-checked against the Java set (IoT SP00)
The IoT Devices rights mirrored, their tree, and the IoT Devices permission group (IoT SP00)
TOUR_PENDING lets an app group exist before its tour ships; IOT until IoT SP05 (master SP05-D7)
IoT Devices in the app mirrors, Organization.isIot and its app icon (IoT SP00)
IoT vendor deliveries are not judged by an organization's IP and country rules (IoT SP00-D5)
IoT Devices in every paid plan, never Free; scan com.kamo.z.shared.iot (IoT SP00)
Gate the eight IoT kinds on their rights with the owner rule, in one display order (IoT SP00)
IOT_EVENTS max-bytes in binary units — nats CLI 0.5 refuses the bare 10737418240 (IoT SP00)
Seed the IoT administration rights to CONFIGURE_SYSTEM holders on the boot that introduces them (IoT SP00)
The IoT tour needs no lineage: every Show Tour right is already on for every role (fefd98c2).
IotRights, the one owner rule every IoT gate applies (IoT SP00)
An SI member never holds the six IoT management rights (IoT SP00-D4)
The IoT Devices rights (370-401) under VIEW_IOT_DEVICES, and SHOW_TOUR_IOT (IoT SP00)
IoT Devices app (40), inside the PHI boundary and never automatic (IoT SP00)
Api.* carve-out for vendor hooks and the Alexa relay with a webhook-sized limit; IoT secrets documented (IoT SP00)
Default-deny egress for kamowsiot and its disruption budget (IoT SP00)
NATS login svc_iot, svc_media iot.live.> grant, IOT_EVENTS work queue (IoT SP00)
Sp00verify lane part 2 (T4 step 5, T9, T11, T12, T13): rulings and acceptance rows
A3 PASS (live reply a model limit), A5, A8 (Lab 2 + step 5 in sp00verify), A10, A12, A13 PASS; A4 row from the Lab 2 lane's T6; A11 NOT PASSED on one criterion ...
Rebuild onto kamo-shared-library 6fce139a
Seeds the new SUSPICIOUS_SIGNIN_DETECTED canonical template, which SecurityService sends for a detection rule's NOTIFY_ADMIN_EMAIL response.
Rebuild onto kamo-shared-library 6fce139a
Picks up OrgStorageAggregator 3eda4b54: BULK_EXPORTS and EXCHANGE_DOCUMENTS read object_storage_days instead of 0.
Run the sign-in detection rules, and make their responses real
SuspiciousDetectionService was injected into SecurityController and evaluate() was never called, so every rule an organization configured on the Security screen...
Encrypt legacy signing secrets at boot; a refused target URL is a 400
The service side of kamo-shared-library e58f1a93 (target vetting + DNS pinning, failure categories, encrypted signing secrets). - **************** (re-runnable...
GD alone no longer grants every right on proxy routes
ksemHasRight treated GD (god-mode ELIGIBILITY) as an all-rights bypass, so every god-eligible operator held every right on the 18 proxy routes that use it, with...
Seal Google/Microsoft calendar OAuth tokens at rest; re-seal legacy rows at boot
GoogleCalendarService and MicrosoftOutlookService stored the access and refresh tokens on third_party_integrations as the provider issued them, although the ent...
The letter a triggered sign-in detection rule sends
SUSPICIOUS_SIGNIN_DETECTED joins the canonical templates. SecurityService's SuspiciousDetectionService sends it when a tenant-configured detection rule (failed-...
Seal member VoIP credentials at rest with PlatformSecretCipher; re-seal legacy rows at boot
**************** held each member's access token, refresh token (Teams, RingCentral OAuth) and RingCentral JWT assertion exactly as the provider issued them. Ev...
Never relay a browser-set X-God-Mode-Active
God mode is SERVER-owned. The billing and LOS proxies copied the browser's X-God-Mode-Active onto the upstream call, and BillingService treated it plus users.is...
God mode comes from the caller's own session window, never a header
BillingService took X-God-Mode-Active plus users.is_god as god mode, and kamo-internal copied that header straight off the browser, so a god-eligible operator h...
Meeting-provider OAuth state is an opaque one-time Redis token; refresh is locked and committed on its own
state was base64 JSON {orgId, nonce, provider} built by the caller, the nonce was never stored or checked, and the sessionless callback trusted the decoded orgI...
Vet and pin every webhook target, return only failure categories, encrypt signing secrets
The outbound webhook worker POSTed to whatever URL a subscriber stored, from inside the cluster, with no egress control - a subscription aimed at **************...
/api/voip/webhook answers a form post 415 and a non-JSON body 400, never a silent 200
A form-encoded post (Twilio, Sinch, Vonage pointed at the wrong address) fell into readTree(), failed, and was answered 200, so the carrier never retried and th...
No literal internal-auth secret fallback — a blank public-chat secret answers 503
Seven @Value sites and application.yml fell back to the literal dev-secret-change-in-prod when **************** was missing, so a pod without its Secret sent a ...
Read the bulk-export and exchange-document sweeps instead of reporting 0
OrgObjectStorageSweep writes BULK_EXPORTS and EXCHANGE_DOCUMENTS rows into object_storage_days, but OrgStorageAggregator only read that table for BRANDING and D...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.