Backend update
Big maintenance update — security, joins, meets, and account stuff. Most of it is behind the scenes; here’s what changed for you.
ACCOUNT & LOGIN
Safer sessions
- When you log in (or finish SMS verification), your session is refreshed so old/stolen cookies can’t stick around. Changing your password signs you out everywhere else. If an account gets banned, active sessions are kicked too.
Rate limits & bot checks
- Login, signup, password reset, and similar pages are rate-limited, and Cloudflare Turnstile fails closed in production (no “skip captcha” shortcut).
CSRF protection
- Forms now carry extra request checks so forged submissions from other sites don’t go through. If something looks off after a long idle tab, refresh and try again.
SMS & phone
- Login codes and phone verification codes are stored more securely. Verifying your number no longer auto-opts you into texts — reminders and SMS login stay your choice in My Account.
- Codes are generated with a stronger random source.
Email links
- Verification, password reset, and email-change links are hashed at rest. If an older link from before this update doesn’t work, just request a new one.
JOIN
Private application photos
- Join photos are stored off the public uploads path and only viewable in admin — not guessable from a public URL.
Safer status checks
- Application status uses an emailed magic link instead of a shareable token URL. Use the join status page to request a fresh email if you need it.
MEETS
RSVPs & reminders
- Meet RSVP / reminder sending is more reliable under double-clicks and overlapping jobs — fewer duplicate texts, fewer missed ones.
BUILD PAGES
Voting & reactions
- Double-submits on vote/react (spam clicking) won’t blow up or create weird duplicate rows.
SITE
FAQ
- FAQ answers with links are escaped properly so markup can’t break the page.
Announcements
- Homepage announcement links only allow real http/https URLs.
Settings & performance
- Public pages don’t expose webhook secrets, and common settings are cached briefly so every page load isn’t a full settings hit.
That’s the batch. See you at the next meet.