Product updates

Changelog

Track customer-facing product improvements, security outcomes, and compliance reporting updates across VAT Engine.

Archive page 33 of 33.

Latest release: 3.6.506; More Complete Blog Subscriptions
Releases tracked: 392; Since January 2026
Logged changes: 1225; Across customer-facing categories

SecurityFeatureImprovementFix

Showing releases 385-392 of 392

2.5.0March 15, 2026

TEDB Admin Panel — Live Rate Sync

3 changes

Feature2 items

Admin TEDB sync dashboard with status cards, diff preview, one-click apply, and sync history
Collapsible diff sections show added, changed, and removed rates with country flags and percentage formatting

Fix1 item

Fixed TEDB SOAP XML namespace qualification — child elements now inherit via default namespace (resolves TEDB-ERR-2 XSD validation error)

2.3.0March 11, 2026

Dashboard & Documentation UX Improvements

3 changes

Feature1 item

API documentation portal with fumadocs MDX, DynamicCodeBlock syntax highlighting, and runtime-resolved API base URLs

Improvement2 items

Extracted shared API key types to lib/api-keys/types.ts — eliminated 4× type duplication with proper union types (APIKeyScope, APIKeyStatus, APIKeyEnvironment)
Scopes field now typed as APIKeyScope[] instead of string[] across all consumers

2.1.0March 7, 2026

Usage Tracking & Rotation UX Improvements

5 changes

Fix2 items

After key rotation, the new secret modal stays open until you confirm the key has been stored — no premature redirect
Viewing a rotated key now shows a banner directing you to the active replacement key

Improvement3 items

Usage charts auto-refresh every 10 seconds and on tab focus
Empty-state messages shown when no usage data exists for a key
Rotated keys enforce a strict 48-hour grace window — requests after expiry are rejected

1.5.10February 28, 2026

Deferred Findings Resolution

1 change

Improvement1 item

Fixed rate-limit docs drift — corrected documented value to match actual default (L-03)

1.5.0February 17, 2026

OTP Verification & Session Security Improvements

11 changes

Security7 items

Two-Factor Authentication (TOTP) with authenticator app support and provisioning codes
TOTP secrets encrypted at rest using secure encryption
Backup codes (one-time use) generated on TOTP enable
Sign-in requires authenticator code or backup code when TOTP enabled
Account recovery flow: backup code → new QR → new authenticator → new backup codes
Session Revocation: all existing sessions revoked on password reset/change
Email tokens now stored as SHA-256 hashes for additional security

Feature4 items

TOTP enable/confirm/disable/recovery flows in security dashboard
Authenticator code entry and validation
QR code provisioning for popular authenticator apps
Backup codes display and download on first enable

1.4.1February 16, 2026

Email Verification & Password Recovery Enhancements

15 changes

Security6 items

Email Verification: time-limited single-use tokens, sign-in blocked until verified
Password Recovery: time-limited single-use tokens with per-email request caps
Password reset immediately revokes all existing user sessions
Session tracking prevents unauthorized access after password changes
Generic success messages on forgot-password to prevent account enumeration
Rate limiting added to email verification resend endpoint

Feature5 items

Forgot Password page with form and honeypot field
Reset Password page with token validation and new password form
Verify Email page for email confirmation flow
Email change confirmation with reverification
Activity logging for email verification and password reset events

Improvement4 items

Consistent response timing for password reset flows
Email verification non-blocking (signup succeeds even if email fails to send)
Resend verification email available for logged-in users
Password requirements enforced: 8-100 characters with uppercase, lowercase, number, special character

1.2.0February 5, 2026

Production-Grade Security & Rate Limiting

12 changes

Security6 items

Distributed rate limiting for authentication endpoints
Bot detection mechanisms
Timing attack protection for authentication operations
Account enumeration prevention
Content Security Policy (CSP) headers configured
Cookie consent banner with GDPR compliance

Feature5 items

Form validation and submission handling improved
Real-time password requirements indicator
Password visibility toggle
UI form components with improved accessibility
Distributed rate limiting service integration

Improvement1 item

Activity logging for all authentication events

1.1.0January 28, 2026

Authentication & Security Overhaul

12 changes

Security5 items

Implemented strong password requirements: minimum 8 characters with uppercase, lowercase, digit, and special character
Added rate limiting to login/signup endpoints to prevent brute-force attacks
Email normalization: all emails converted to lowercase to prevent account duplication
Generic error messages to prevent user enumeration attacks
Secure password handling: passwords cleared from state after validation errors

Feature3 items

Password confirmation field for signup with real-time match validation
Show/hide password toggle buttons for better UX during password entry
Live password requirements indicator showing uppercase, lowercase, number, and special character status

Improvement4 items

Enhanced login/signup UI with better error handling and visual feedback
Disabled submit button during signup until all password requirements are met
Improved accessibility with proper aria-labels and semantic HTML
Better placeholder text and form labels for clarity