Security, reviewed three more times
Three rounds of whole-codebase security review ran in September. What changed that you might notice: a member adding a second email address now confirms it with a code before it can be used to sign in; when someone’s sign-in address changes, or you press Disable Sign-In, their old sign-ins end; only someone on your Admin Team can make a person a Board Member, because that tag opens the admin; wrong sign-in codes are limited to 30 a day for any one address; and a CE certificate can no longer be collected through an email address nobody proved was theirs.