What's new in Vaultez

• No links in names. Names appear in the emails Vaultez sends, such as invitations and shared links, so they can no longer contain links or web addresses. People's names can use letters from any language, including accents and one-letter names, plus spaces, apostrophes, hyphens and periods. Company names can still use digits and punctuation. Existing accounts are not affected until a name is changed.

• Hand a project over to another company (Pro), for example to a client when your work is done. A project owner who is a member of the receiving company requests the move in the project's settings. An owner of your company approves first, then an owner of the receiving company, each confirming with their password; if you own a company yourself, your side is approved right away.

• What moves: the secrets with their notes, tags and history, and you as the project's owner. Everyone else loses access and is added again by the new company. Project tokens are revoked and unopened share links are cancelled.

• Everyone is told. All project members are emailed when the move is requested and again when it happens, so anyone who didn't expect it can speak up. The request can be cancelled until it's approved and expires after 7 days.

• A record stays behind. Company owners see the projects moved into or out of their company on the company page, with who requested and approved each move. The history itself moves with the project.

• Transfer emails leave out company names. A company's name is chosen by whoever creates it, so the emails keep to the project and the people involved; the details are shown after you log in.

• The receiving company sees only the project owner, not who else is on the project.

• Send several secrets of a project in one link (Pro, project owners and admins). Choose Share secrets on the project page, then pick the secrets: all are ticked, and you can narrow them down by tag. It works like sharing a single secret: a one-time link by email, a passphrase only you see, and an expiry of 1 hour, 1 day or 7 days.

• Ready for a .env file. The recipient sees the secrets in a table, hidden until they reveal them, and can copy them one by one, copy them all as .env, or download a .env file. Secrets whose name isn't a valid environment variable name, or whose value can't be written to the file safely, are flagged and left out of it, to copy individually.

• Always current. If any shared value changes, or a shared secret is deleted, before the link is opened, the link is cancelled and you're emailed to share again. The share is recorded in the history of every secret included, and the new Shares tab on the project lists every link sent, and lets you cancel those not yet opened.

• Links follow the sender's access. A link that hasn't been opened stops working if the person who sent it is removed from the project, loses the role needed to share, or the company moves to the Free plan. Cancelling a link still works on Free.

• Safe .env files. Values are written so that tools loading the file read them exactly as shared: they never run commands, expand variables or add lines from them. A value that can't be written that way is left out of the file.

• Each copy is recorded once per link and secret, so a recipient can't fill the history with repeated copies.

• Share a copy of a secret with people outside Vaultez (Pro). Vaultez emails a one-time link that expires after 1 hour, 1 day or 7 days. The recipient also needs a passphrase that Vaultez generates and shows only to you, so you can pass it on another way. The copy is decrypted in the recipient's browser with a key we don't keep. If the value changes before the link is opened, the link is cancelled and you're emailed to share again.

• Every access to a value is logged. Secret values are no longer part of the page: they stay hidden until you reveal or copy them, and each reveal, copy, CLI fetch and project-token fetch appears in the secret's activity history, each with its own icon.

• Choose a company after login. If you belong to several companies, you pick which one to open.

• Warnings before a downgrade. Owners are emailed 7 days and 1 day before a trial ends or a cancelled plan expires, and right away when a payment fails, with a list of what will stop working.

• New backup codes on demand. Account settings show how many two-factor backup codes you have left, and you can generate a new set after confirming your password and a code. You're emailed whenever this happens.

• A public security page describing where data is stored, how it's encrypted and who can access it.

We ran a series of internal security reviews and fixed everything they found. No customer data was exposed. The main improvements:

• Removing someone fully removes their access. Removing a member from a company or project now also ends their CLI access and revokes the project tokens they created.

• Invitations must be accepted. Existing Vaultez users are only added to a company after they accept the invitation while logged in.

• Stronger sign-in. Logging out ends the session everywhere; sessions expire after 12 hours of inactivity; changing your password or email signs you out on all devices, and a password change also revokes CLI tokens; password reset links work once; login and 2FA attempts are rate limited.

• More data encrypted. Secret notes, the details in the activity history and 2FA secrets are now encrypted, like secret values already were.

• Tighter permissions. Only people who manage a secret's access can change who sees it, only project owners can delete a project, and billing is limited to company owners.

• Browser protections. A strict Content Security Policy, integrity-checked third-party files, and pages showing secret values are never cached.

• Up-to-date dependencies, including Rails 8.1.4, with no known vulnerabilities.

• Free now includes unlimited secrets, in 1 project for 1 user.

• The CLI, project tokens and the activity history are part of Pro. On Free, activity is still recorded, so the full history is there as soon as you upgrade.

• Going over the Free plan's limits (for example after a trial ends): the company's first project stays fully usable for the owner who created the company. Other projects are shown as locked and become read-only: their secrets can still be viewed, copied and deleted, but not changed. Nothing is deleted, and upgrading restores everything.

• Backup codes are shown after setting up two-factor authentication. Until now this page was skipped, so if you never saw your backup codes, generate a new set in Account settings.

• The welcome tour no longer covers your backup codes, and people joining through an invitation skip it.

• People without a company can create one again instead of being sent round in a loop.

• Clearer pricing. The pricing pages now show exactly what each plan includes.

• You'll be signed out once after this update.

• The edit page no longer shows the current value. Leave the value empty to keep it; to see it, reveal it on the secret page.

• Notes are text only; file attachments are no longer supported.

• Email addresses are case-insensitive, so you can sign in however you type yours.