Enhanced Security and Delivery Control
This release introduces global preference controls allowing you to opt out of non-critical transactional emails, along with full support for machine-initiated one-click unsubscribes. We have also hardened our security architecture by securing client IP verification and eliminating timing side-channels in token comparisons. Finally, backend worker stability and scraping resilience have been optimized to ensure reliable performance under heavy usage.
You can now globally opt out of non-critical transactional and account emails directly from your preferences. This gives you full control over which notifications reach your inbox.
We added native support for machine-initiated unsubscribe requests. Email clients like Gmail can now unsubscribe you in one click without executing front-end code.
We optimized our database query pathway for opt-out lookups, achieving up to a 25x reduction in latency. This ensures that your system and verification emails are dispatched almost instantaneously.
New Features
2Global Email Opt-Out Control
You can now globally opt out of non-critical transactional and account emails directly from your preferences. This gives you full control over which notifications reach your inbox.
Machine-Readable Unsubscribe Support
We added native support for machine-initiated unsubscribe requests. Email clients like Gmail can now unsubscribe you in one click without executing front-end code.
Improvements
6Faster Email Notification Speeds
We optimized our database query pathway for opt-out lookups, achieving up to a 25x reduction in latency. This ensures that your system and verification emails are dispatched almost instantaneously.
Guaranteed Organization Alerts
Critical organization and security notifications now bypass global opt-out settings. This ensures you never miss vital security updates, member invitations, or ownership transfers.
Reliable One-Click Unsubscribe
One-click unsubscribe headers are now consistently preserved and sent across fallback email channels. This guarantees a seamless unsubscribe experience regardless of the delivery path used.
Worker Capacity Under Heavy Load
We restored fail-fast backpressure mechanisms for background task workers during peak usage. This prevents resource exhaustion and ensures high-volume scraping tasks execute with high stability.
Robust Detection System Adaptation
We unified our block-handling logic into a vendor-agnostic escalation policy. This allows your scraper requests to gracefully adapt when encountering aggressive target detection systems.
General bug fixes and improvements
Plus 58 internal improvements for better reliability and performance.
Bug Fixes
5Corrected Unsubscribe Rate Limiting
We resolved duplicate rate-limit checks and corrected client IP forwarding. This ensures that legitimate unsubscribe requests are not falsely blocked by shared rate-limit buckets.
One-Click Unsubscribe Timeout
Added an automated request timeout to our unsubscribe proxy handler. This prevents slow backend responses from hanging or stalling your browser session indefinitely.
Unsubscribe Link Rendering Fix
Fixed a bug where unsubscribe links in lifecycle emails rendered raw template variables instead of the actual signed URL. Unsubscribe links in all automated emails are now fully functional.
Notification Status Reporting Fix
Fixed a visual reporting bug where automated email metrics were permanently stuck in a queued status in the dashboard. Delivery status now updates accurately to reflect successful dispatches.
Resilient Daily Limit Enforcement
Fixed an issue where daily email send limits failed open during temporary database disruptions. Daily send caps are now securely maintained and enforced under all conditions.
Security
3Harden Client IP Verification
We removed insecure client IP fallbacks across authentication and proxy handlers, relying strictly on trusted, unspoofable headers. This prevents IP-spoofing attacks on sensitive endpoints.
Secure Token Comparison
We hardened authentication pathways against potential timing side-channel attacks by implementing constant-time token verification. We also resolved an exception triggered by non-ASCII headers.
Email Header Injection Protection
We added explicit newline stripping to custom email headers to prevent carriage return/line feed injection. This hardens our transactional email system against malicious header manipulation.
Plus 58 internal changes for stability and performance.