warmbly

accounts-and-access.mdx

feat: add audited repeat-safe sample data provisioning for active dedicated Test workspaces in Admin Testers

2026-10-06 09:23:31 +00:00

admin-panel.mdx

feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates

2026-10-07 14:02:11 +00:00

architecture.mdx

feat: keep worker farewell heartbeats independent of IP discovery and identify CPU-set resource scope accurately

2026-10-05 11:43:16 +00:00

bare-metal.mdx

feat: redesign the admin panel in a black and white dark-first theme with grouped sidebar sections, header tabs, a collapsible animated sidebar and a rebuilt sign-in, alert operators on admin sign-ins and admin access changes through opsnotify, and carry first-touch attribution from the marketing site to every dashboard link

2026-10-05 03:01:22 -07:00

configuration.mdx

feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates

2026-10-07 14:02:11 +00:00

data-control.mdx

feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates

2026-10-07 14:02:11 +00:00

deployment-guide.mdx

feat: redesign the admin panel in a black and white dark-first theme with grouped sidebar sections, header tabs, a collapsible animated sidebar and a rebuilt sign-in, alert operators on admin sign-ins and admin access changes through opsnotify, and carry first-touch attribution from the marketing site to every dashboard link

2026-10-05 03:01:22 -07:00

events.mdx

feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates

2026-10-07 14:02:11 +00:00

first-run.mdx

feat: require a verified Cloud Tasks token with a pinned audience on task webhooks, manage_settings on integration OAuth and a fresh membership check at every mailbox and integration OAuth finish, user verification for passkey sign-in, ended sessions before a password reset or ban reports success, and a revoked session when a rotated refresh token is replayed; remove the internal DEK delete route, log credential path parameters by name, hold remote images in received mail until the reader loads them, add Calendly and Cal.com signing keys with inbound URL rotation, keep automation signing secrets out of connection responses, and apply the password rules to the bootstrap password

2026-09-30 06:46:24 -07:00

install.mdx

feat: integrate current main with a single consumer schema and relation visibility guard while preserving migration cancellation diagnostics and regression coverage

2026-10-07 07:49:50 +00:00

instance-health.mdx

feat: correct split-host admin health checks and registration notices, distinguish informational context from problems, and add audited expired-invitation cleanup

2026-10-05 11:17:13 +00:00

local-development.mdx

feat: accept only Salesforce domains as an org's API host and call it through the SSRF-guarded client, register the Warmbly Cloud link only on self-hosted instances behind the instance admin with a second factor and dial it through safehttp with fixed error text, keep automation signing secrets in the sealed connection config, answer integration service failures with fixed messages, add security headers to the forms, tracking and docs origins and TLS 1.2+ to the nginx template, compare the captcha bypass in constant time, require TLS 1.2 for IMAP probes, and drop the unused RSA helpers

2026-10-04 02:58:43 -07:00

meta.json

feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates

2026-10-07 14:02:11 +00:00

operator-notifications.mdx

feat: guard configuration tab links against losing unsaved edits, keep the login captcha mounted for resend, confirm warmup appeal decisions by mailbox, show header tabs only on section pages, show the update pill in the mobile drawer, make admin sign-in alerts opt-in per channel, check the admin bit before loading the account, and alert on admin access only when it changes

2026-10-05 03:21:44 -07:00

sandbox.mdx

feat: send each mailbox's reply-to as a Reply-To header on campaign, unibox, test and placement mail (never warmup), record it on every campaign send attempt (tasks.reply_to, migration 000236) and credit a reply landing in that shared reply inbox to the campaign and its sending mailbox across reply attribution, the sync priority lane and copied-contact replies, show the sending mailbox on thread messages, recent activity and the reply webhook, start unibox and inbox-agent replies from the mailbox that emailed the contact, flag an untracked reply-to in mailbox settings, let the sandbox simulator answer Reply-To, and document the shared reply inbox (#756 )

2026-09-30 05:33:34 -07:00

send-safety.mdx

feat: complete native and Cloud diagnostic consent immutable shared provider attempt accounting authorized bounded IMAP timing retries conservative feedback pacing and released-schema correction fixtures

2026-10-07 15:12:45 +00:00

slack-app.mdx

feat: link Slack members to Warmbly automatically by matching email, add Continue with Slack (Sign in with Slack) for mismatched emails, and move the Slack link page to a standalone /slack/link screen

2026-10-05 05:00:22 +00:00

split-deployment.mdx

feat: deploy configurable Cloudflare Pages project lists from exact releases with isolated dashboard, admin, site and docs builds

2026-10-05 09:48:40 +00:00

troubleshooting.mdx

feat: serve every node-only internal route (data keys, message map, sync lookups, worker config, fleet heartbeat) on NODE_BROKER_TOKEN and leave only tracked links, domain redirects, page hits and forms on INTERNAL_API_TOKEN, render nodes only the node token when one is set, and have the installer generate a distinct NODE_BROKER_TOKEN for new installs and its own UPDATER_TOKEN

2026-10-04 03:21:58 -07:00

updates.mdx

feat: redesign the admin panel in a black and white dark-first theme with grouped sidebar sections, header tabs, a collapsible animated sidebar and a rebuilt sign-in, alert operators on admin sign-ins and admin access changes through opsnotify, and carry first-touch attribution from the marketing site to every dashboard link

2026-10-05 03:01:22 -07:00

warmblyctl.mdx

feat: charge every password, emailed-code and TOTP attempt atomically before comparing it (Redis INCR+expire script) with a per-account TOTP budget across challenges, put the signed-in password change on the reauth budget, set the per-account login limit to 50 per hour, give tester passwords an expiry (users.password_expires_at, migration 000257) and clear them plus every session on revoke, mint warmblyctl reset links with the password-reset purpose, expire fleet join tokens (7 days default, 30 max, reusable inside the window), derive captcha from the resolved Turnstile secret, refuse weak bootstrap argon2id hashes, make registration codes single-use, rate-limit the v1 invitation lookup, and draw RIDs and user codes without modulo bias

2026-10-04 02:52:22 -07:00

warmup-generation.mdx

feat: enforce shared outbound capacity and directional diagnostic consent across campaign manual warmup and seed dispatch with transactional result outbox bounded Gmail Graph DKIM audited repair holds and legacy upgrade gates

2026-10-07 14:02:11 +00:00

whole-domain-connect.mdx

feat: bind Warmbly Cloud brokered mailbox sign-ins to PKCE, a single-use state and a cloud consent page naming the requesting instance and workspace that sets the browser cookie the callback requires, return only to the instance's registered address, add PKCE and an OIDC nonce to Workspace and Microsoft 365 admin-proof sign-ins, post OAuth callback codes only to a configured dashboard origin, cap CLI-approved keys to the approver's role behind a fresh sign-in, and accept only same-origin login next paths

2026-10-04 02:53:16 -07:00