Alpha testing: all current functionality is free while VAT Engine is in active development

VAT Engine logo
Product updates

Changelog

Track customer-facing product improvements, security outcomes, and compliance reporting updates across VAT Engine.

Archive page 23 of 23.

Latest release
3.6.383
Cross-platform Decision Replay Is Clearer
Releases tracked
270
Since January 2026
Logged changes
785
Across customer-facing categories
SecurityFeatureImprovementFix

Showing releases 265-270 of 270

2.1.0March 7, 2026

Usage Tracking & Rotation UX Improvements

5 changes
Fix2 items
  • After key rotation, the new secret modal stays open until you confirm the key has been stored — no premature redirect
  • Viewing a rotated key now shows a banner directing you to the active replacement key
Improvement3 items
  • Usage charts auto-refresh every 10 seconds and on tab focus
  • Empty-state messages shown when no usage data exists for a key
  • Rotated keys enforce a strict 48-hour grace window — requests after expiry are rejected
1.5.10February 28, 2026

Deferred Findings Resolution

1 change
Improvement1 item
  • Fixed rate-limit docs drift — corrected documented value to match actual default (L-03)
1.5.0February 17, 2026

OTP Verification & Session Security Improvements

11 changes
Security7 items
  • Two-Factor Authentication (TOTP) with authenticator app support and provisioning codes
  • TOTP secrets encrypted at rest using secure encryption
  • Backup codes (one-time use) generated on TOTP enable
  • Sign-in requires authenticator code or backup code when TOTP enabled
  • Account recovery flow: backup code → new QR → new authenticator → new backup codes
  • Session Revocation: all existing sessions revoked on password reset/change
  • Email tokens now stored as SHA-256 hashes for additional security
Feature4 items
  • TOTP enable/confirm/disable/recovery flows in security dashboard
  • Authenticator code entry and validation
  • QR code provisioning for popular authenticator apps
  • Backup codes display and download on first enable
1.4.1February 16, 2026

Email Verification & Password Recovery Enhancements

15 changes
Security6 items
  • Email Verification: time-limited single-use tokens, sign-in blocked until verified
  • Password Recovery: time-limited single-use tokens with per-email request caps
  • Password reset immediately revokes all existing user sessions
  • Session tracking prevents unauthorized access after password changes
  • Generic success messages on forgot-password to prevent account enumeration
  • Rate limiting added to email verification resend endpoint
Feature5 items
  • Forgot Password page with form and honeypot field
  • Reset Password page with token validation and new password form
  • Verify Email page for email confirmation flow
  • Email change confirmation with reverification
  • Activity logging for email verification and password reset events
Improvement4 items
  • Consistent response timing for password reset flows
  • Email verification non-blocking (signup succeeds even if email fails to send)
  • Resend verification email available for logged-in users
  • Password requirements enforced: 8-100 characters with uppercase, lowercase, number, special character
1.2.0February 5, 2026

Production-Grade Security & Rate Limiting

12 changes
Security6 items
  • Distributed rate limiting for authentication endpoints
  • Bot detection mechanisms
  • Timing attack protection for authentication operations
  • Account enumeration prevention
  • Content Security Policy (CSP) headers configured
  • Cookie consent banner with GDPR compliance
Feature5 items
  • Form validation and submission handling improved
  • Real-time password requirements indicator
  • Password visibility toggle
  • UI form components with improved accessibility
  • Distributed rate limiting service integration
Improvement1 item
  • Activity logging for all authentication events
1.1.0January 28, 2026

Authentication & Security Overhaul

12 changes
Security5 items
  • Implemented strong password requirements: minimum 8 characters with uppercase, lowercase, digit, and special character
  • Added rate limiting to login/signup endpoints to prevent brute-force attacks
  • Email normalization: all emails converted to lowercase to prevent account duplication
  • Generic error messages to prevent user enumeration attacks
  • Secure password handling: passwords cleared from state after validation errors
Feature3 items
  • Password confirmation field for signup with real-time match validation
  • Show/hide password toggle buttons for better UX during password entry
  • Live password requirements indicator showing uppercase, lowercase, number, and special character status
Improvement4 items
  • Enhanced login/signup UI with better error handling and visual feedback
  • Disabled submit button during signup until all password requirements are met
  • Improved accessibility with proper aria-labels and semantic HTML
  • Better placeholder text and form labels for clarity