2026-08-01

🔒 Security hardening

This release closes a set of gaps found in a focused security review:

• Suspending a member now cuts off their API keys. A key belonging to a suspended membership no longer authorizes requests against your organization — no need to hunt down and revoke each key individually. Allow a few minutes for the change to take effect. 📚 API Keys
• Sign-in restrictions are enforced on every surface. An organization that disallows Google sign-in now has that enforced consistently — across the API, realtime updates, and administrative actions — not just at the login page. Organizations that allow it (the default) see no change, and password sign-in is unaffected everywhere.
• Link previews refuse internal addresses. When DevStride fetches a URL you attach to a work item, it now refuses private and internal network addresses — including after redirects — so the server can't be tricked into reaching somewhere it shouldn't.
• Upload lockdown. File uploads that a browser would execute rather than display (disguised HTML and scriptable SVG variants) are now refused across every upload path, keeping the media CDN strictly for content.

🔑 A new sign-in address

Signing in now happens at login.devstride.com instead of an amazoncognito.com address — a proper DevStride domain in your address bar during the sign-in redirect. Both Google and password sign-in work exactly as before, and the old address remains valid, so nothing to update on your side.

🤖 Attach files through the MCP server

AI assistants connected through the DevStride MCP server can now attach files to work items, not just read and edit them — drop a log, screenshot, or document onto an item straight from your assistant.

🛠 Fixes

• REST API from cloud hosts — API calls using Basic authentication were rejected with 403 Forbidden when sent from some cloud-hosted servers, because those HTTP stacks lowercase the auth scheme. All standard spellings are now accepted.
• Formatting toolbar stays put — the toolbar no longer scrolls out of view while you work through a long work-item description, and content no longer peeks through the gap above it.
• Map stays steady — the map view no longer lurches sideways mid-drag when a side panel opens.
• Notifications keep flowing — scrolling deep into older notifications could stop the list from picking up new ones until you changed filters; it now always catches up.