Skip to content

← All releases

Security: public file links need an admin’s switch, and removing a passkey asks for proof

Public links to files are off until a workspace admin turns them on, retention now removes files with their messages, and removing a passkey asks for your password or a code.

Public links to files are off in every workspace until an owner or admin turns them on under Settings › Permissions, and guests can never make one. Turning the switch off stops every existing link at once, and admins can see and revoke the workspace’s live links. When retention deletes a message, its attachments and their links go with it. Removing a passkey asks for your password, a two-step code or a recent sign-in, and you get an email about it.

Deactivating a member disconnects their open sessions at once. In Kemble Work an incoming webhook stops posting while the person who added it is deactivated or gone, and starts again if they come back. On the website, moving between pages puts focus at the top of the new page, the security contact on /trust is a link, and the changelog’s month links are labelled and easier to press.

More from October 2026