← All releases

Version 0.30.6

• SecuritySafety report flood hardening

  Public safety reports past the hourly site cap are now stored and flagged as overflow without alerting, and identical repeat reports are folded into the original so real reports are never buried.

Version 0.30.5

• FixSign-in safety check now has a text question too

  When GreenRoom asks for a safety check at sign-in, there is now a plain-text question you can answer instead of reading the picture. It works with a keyboard and with screen readers.

Version 0.30.4

• ChangeThe handwritten note on the home page now uses its own font

  The "Already have an account or invite code?" note is written in Caveat, a handwriting font that now ships with GreenRoom, so it looks the same on every device. Credits lists the font and its licence.

• SecurityMaintenance mode no longer shows which sign-in name is the owner

  While the site is in maintenance mode, a wrong password now gets the same answer for every name.

Version 0.30.3

• ChangeWhat's new details: close button stays full size

  The close button on the Details panel no longer shrinks in Firefox.

• SecuritySign-in is harder to abuse

  Repeated successful sign-ins from one address or account are now slowed, anonymous requests need a genuine signed session cookie to skip the limit, an email and its username count as one name, and IPv6 addresses are limited by network prefix. Sign-ins for normal people are unchanged.

Version 0.30.2

• SecuritySign-in keeps your username after a wrong password; security log no longer stores unknown names

  After a wrong password the username box stays filled (never the password). Failed sign-ins for names that match no account are logged as a short hash instead of the typed text.

Version 0.30.1

• SecurityTwo-factor settings are protected from password guessing

  Turning off two-factor or making new recovery codes now locks after 5 wrong passwords for 15 minutes, so a stolen session cannot guess your password there.

Version 0.30.0

• NewSee where visitors come from and where they leave

  Platform > Analytics now shows each signed-out visit's source (the ?utm_source tag or the site that linked), the page it landed on and the page it left from, including visits that were simply abandoned. No cookies, no IP stored, Do Not Track respected, secret links hidden. A token-protected JSON export is available at /a/visits.json. Off until switched on under Platform > Flags (Visitor log).