Live Change Log

The compliance assessment called the absence of any second factor disqualifying on its own, and under the 2025 Security Rule NPRM MFA stops being addressable at...

- Mount analyticsAnalytics client component in the root layout: next/script loader for analytics.kamocrm.com scoped via data-domains to login.kamocrm.com on...

Backs UserMfaEnrollment and MfaRecoveryCode in kamo-shared-library — §164.312(d) Person or Entity Authentication, the gap the compliance assessment called disqu...

Recording and voicemail playback checked tenancy and nothing else: any member of the owning org could pull any call in it, transcript included, on extensions th...

A session left open on an unattended workstation stayed usable indefinitely. This terminates it after 15 minutes of no interaction, with a 60-second warning so ...

WOPI serves whole documents to Docs and recorded nothing. GET /wopi/files/{id}/contents is the same disclosure as /download, relayed the same way through APISer...

Avatars, org logos and backgrounds stopped loading for every tenant. Two separate regressions I introduced in 36ad904b, both live for hours. 1. The per-request...

For an ELIGIBILITY_MATRIX source document the ingestion panel now shows a "Promote as eligibility matrix" card: pick the product, limit type (MAX_LTV/CLTV/DTI),...

**************** gain promote-eligibility, mirroring promote-adjustments: god-eligible gate, organizationId server-stamped via write(), downstream 4xx relayed v...

ResourceServerConfig is anyRequest().permitAll() and @EnableMethodSecurity appears nowhere in this service, so every @PreAuthorize is inert and public is the de...

Completes the quote/estimate system: staff can now build a quote, price it, mint a share link and email it, all from the pipeline. app/lib/quotesApi.ts ...

remotePatterns was [{ protocol: "https", hostname: "**" }]. That made the image optimizer a general-purpose fetcher: any caller could ask this server to retriev...

HIPAA §164.312(b) for SecurityService. The platform records every lead CHANGE (LeadHistory) and every login (SystemAccessLog) and records no READ at all, so "wh...

The customer-facing surface for the commerce quote system. Server-rendered so the org's branding is in the first paint — an unbranded flash on a commercial docu...

Staff endpoints at /api/security/commerce/quotes and an unauthenticated resolver at /api/security/public/quotes. QuoteController extends BaseLosController rath...

Adds a first-class Quote alongside the existing commerce spine. The pre-existing "ServiceQuote" is an Intent plus a JSON blob carrying one offering and one flat...

Reinstates what 8f6c672 reverted, in the only form that actually works here. The earlier attempt failed because a plain NetworkPolicy cannot express this clust...

A thread with five people on it was represented by one arbitrary face, which reads as a message from one person. Up to three participants now overlap, so "sever...

Every failure mode in this feature is silent. A latched circuit breaker, a worker queue discarding every task, a provider that started returning HTML — each loo...

The ingestion panel could only publish a rate sheet. For an LLPA_MATRIX source document it now shows a "Promote as LLPA adjustments" card: pick the existing rat...

**************** gain promote-adjustments, mirroring the promote-rate-sheet relay: god-eligible gate, organizationId server-stamped onto the payload via write()...

Recording playback left no trace. A recorded call is the densest PHI the platform stores — the unredacted conversation — and "who listened to this call" was una...

Both list views keyed a row on its sender, so every row of the reader's own outbox showed the reader — their photo, their name, their address. The message list ...

The settings endpoint required MANAGE_EMAIL_AVATAR_SETTINGS and nothing else, so it shipped dormant: a brand-new right is held by nobody until an admin assigns ...

Wires the shared §164.312(b) spine into the paths that read persisted prompts and completions. The assistant is the module the compliance assessment put OUTSIDE...

Sending a message left a row; reading one left nothing. Every chat, support and social thread on the platform renders from a handful of endpoints here, and none...

Staged and committed as-is so nothing is left uncommitted in the working tree. 1 file changed, 1 insertion(+)

Staged and committed as-is so nothing is left uncommitted in the working tree. 16 files changed, 3396 insertions(+)

Staged and committed as-is so nothing is left uncommitted in the working tree. 4 files changed, 72 insertions(+)

Staged and committed as-is so nothing is left uncommitted in the working tree. 26 files changed, 7894 insertions(+), 8 deletions(-)

Staged and committed as-is so nothing is left uncommitted in the working tree. 5 files changed, 4879 insertions(+), 12 deletions(-)

Reverts the policy added in 06db7db and patched in 24f76ae. It took SecurityService down for roughly six minutes in production (pod 0/1, Hikari connections dyin...

Staged and committed as-is so nothing is left uncommitted in the working tree. 31 files changed, 691 insertions(+)

Staged and committed as-is so nothing is left uncommitted in the working tree. 76 files changed, 254 insertions(+)

Staged and committed as-is so nothing is left uncommitted in the working tree. 5 files changed, 549 insertions(+), 2 deletions(-)

Staged and committed as-is so nothing is left uncommitted in the working tree. 4 files changed, 397 insertions(+), 3 deletions(-)

Staged and committed as-is so nothing is left uncommitted in the working tree. 1 file changed, 12 insertions(+)

Staged and committed as-is so nothing is left uncommitted in the working tree. 2 files changed, 435 insertions(+)

Staged and committed as-is so nothing is left uncommitted in the working tree. 3 files changed, 353 insertions(+), 4 deletions(-)

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...

dl.k8s.io over the runner's egress intermittently drops mid-transfer: curl: (56) OpenSSL SSL_read: decryption failed or bad record mac which fails the deploy ...