Open Chat Updates

This release tightens privacy and security across the app. Analytics pageviews now strip sensitive URL parameters, user lookups no longer return encrypted credentials to clients, and third-party scripts are verified with integrity checks to reduce supply-chain risk.

This release tightens privacy and security in a few key places. Analytics pageviews now exclude sensitive URL parameters, user lookups no longer return encrypted credential fields to clients, and third party scripts are verified with integrity checks before they run.

This release tightens privacy and security in a few key places. Analytics pageviews now avoid capturing sensitive URL parameters, user lookups no longer return encrypted fields in client-facing responses, and third-party scripts are verified with Subresource Integrity checks to reduce supply-chain risk.

This release tightens privacy and security across the app. Analytics pageview URLs are now sanitized to avoid forwarding sensitive query parameters, user lookups no longer return encrypted secret fields to clients, and third-party scripts now use integrity checks to help prevent tampered assets from running.

This release adds model benchmark data and surfaces it directly in the model selector with a new info panel. You will also see clearer capability indicators, smoother tooltip positioning, and better visual cues like fork markers in the chat sidebar, helping you choose the right model faster.

This release moves key account and chat actions into secure, workflow-driven endpoints. You can now generate chat titles more reliably, export chats through a dedicated workflow API, and delete your account via a safer multi-step process, with clearer rate-limit messaging and tighter authorization checks throughout.

This release closes an access control gap in the chat API that could let an authenticated user access or overwrite another user’s chat stream data by supplying a chat ID they did not own. The chat endpoints now verify chat ownership before reading stream metadata or initializing streaming, helping keep chat activity private and correctly scoped.

This release strengthens security in the ChartStyle component by sanitizing chart IDs and color values before they are used to generate injected styles. It helps prevent CSS or HTML injection risks if those values ever become user-controlled, and skips invalid color inputs to avoid unsafe output.

This release tightens security across the app by preventing unauthorized access to streaming content, reducing the risk of session exposure in the browser, and restricting cross-origin access to the public stats endpoint. It also hardens chart styling to block CSS injection vectors while keeping behavior consistent for valid inputs.

This release tightens access controls around streamed message content and reduces cross-site risks across the app. It also hardens chart styling against CSS injection and narrows cross-origin access to the public stats endpoint, helping keep data exposure and session risk lower.