Open Chat Updates

This release tightens access controls around streaming content and reduces exposure to injection-style attacks in the UI. It also narrows cross-origin access to the public stats endpoint, helping keep data access aligned with your allowed origins.

Typing status endpoints now verify that you own the chat before allowing typing updates or reads. If a chat does not belong to you, the request is blocked with a 403 Forbidden response, helping prevent presence spoofing and reducing the risk of chat ID enumeration.

Search result links are now validated before they render, helping protect you from unsafe URLs that could lead to XSS or phishing. Links using non-web schemes like javascript: or data: are no longer clickable and will display as plain text instead.

Web search now enforces daily limits more reliably, even when multiple searches run at the same time. If the limit is reached, searches stop cleanly with a clear message, helping prevent unexpected overages and reducing confusing partial results.

Chat now shows user-friendly error messages instead of exposing internal details, helping protect sensitive implementation information. We also tightened validation for step limits during streaming to avoid invalid values causing unexpected behavior.

This release adds email and password sign-in plus a new global keyboard shortcuts system, including a searchable shortcuts dialog and key remapping in Settings. It also strengthens security by tightening origin and rate-limit protections and by removing client-side storage of sensitive sign-in related data, reducing risk from spoofed or cross-site requests.

Chats are now easier to manage with automatic titles generated from your first message, plus new options to rename or delete chats directly from the sidebar. A new Chat section in Settings lets you choose title length and control whether deletions require confirmation.

The changelog experience has moved from an iframe-based dropdown to an in-app embedded widget. It now loads directly on the home page for authenticated users, reducing UI clutter and making release updates easier to access without the dropdown menu.

This release adds new About, Privacy Policy, and Terms of Service pages, plus footer links to reach them quickly. It also updates site metadata and crawling rules, including a new sitemap and clearer indexing guidance, so public pages are easier to discover while private areas stay out of search results.

You can now permanently delete your account directly from the settings page. The flow includes a clear confirmation step to help prevent accidental deletions, and deletion removes your chats, messages, uploads (including stored files), prompt templates, profile, and active sign-in sessions.