v3.6.0MINOR
Security review, AI guardrails & bot protection
- ImprovedCompleted a full security review: tighter checks on webhooks, scheduled jobs, workspace data, plans and booking links, plus security headers across the site.
- NewEvery AI text is checked before it's sent: no rate quotes, no approval promises, only Capto links, and a length cap. A blocked reply becomes a polite note that you'll follow up.
- ImprovedFirst texts to new leads never repeat what a stranger typed into your form, and the AI books at most one upcoming call per contact.
- NewCloudflare bot checks on sign-in, sign-up, password reset and your public lead form.
- ImprovedChanging or resetting your password signs out your other devices. Sign-in messages no longer reveal whether an email has an account. New passwords need at least 8 characters.
- ImprovedThe reply simulator now uses exactly the same instructions as live replies, so what you test is what leads get.
- FixedDown-payment talk like "about 5% down" is no longer mistaken for a rate quote.