Changelog: Security, October 2026
43 releases, newest first, by the week and the day they shipped.
Week of 26 October
2 releases
28 October 2026
A decision layer that only ever adds, and a website for every thumb
Kemble now has a decision layer, Baseten’s mammoth decision model, which answers typed questions with probabilities and never with text. It puts urgent reports first, reads Circle’s new Intent review rules, files scam message requests under Spam, warns on look-alike sign-in pages, adds a Decide step to workflows and sorts the contact form, and it never deletes, blocks or bans anything.SecurityFairer deals, and Circle’s call bar as the owner drew it
Games now shuffle, deal and roll from ChaCha20 with a 256-bit key for each game. Circle’s voice rooms and stages get Invite, Pop out and Full screen at the call bar’s edges, a header with just the chat and one More, a captions language you can choose before turning them on, and an icon-only call bar on phones.Security
Week of 19 October
22 releases
22 October 2026
Safety and plans: making a private channel public, refunds that end a plan, and Aura’s upload size
Only workspace admins can make a private channel public; a refund or chargeback ends the plan it paid for; Aura’s larger upload size applies everywhere.Security
21 October 2026
Deleted channels take their files, routines stay where their readers are, and links pause with a pending deletion
A deleted channel’s files go with it; a K Buddy routine never summarises a private place into a wider one; your public links pause while your account deletion waits.Security
20 October 2026
Quieter lock screens, a confirmed download of everything, and automated replies kept to members
With previews off, a notification’s title leaves out what it is about; an export of everything asks you to confirm before it downloads.SecurityChanging single sign-on, SCIM or full exports asks you to confirm it’s you
An owner confirms with a two-step code, a password or a recent sign-in before changing how everyone signs in or exporting private conversations.SecurityHostile PDFs are read in a contained process, and guests hear only about their own channels’ people
A PDF built to exhaust memory is stopped quickly; a guest limited to some channels no longer sees everyone’s presence; Circle never shares when strangers were last seen.SecurityLink previews and document reading hold up against hostile files, and stricter SCIM checks
A crafted web page or Office file can no longer stall previews or summaries; a phone set to Nothing is not told a Link started; SCIM refuses malformed requests plainly.SecurityReminders respect closed channels, QR sign-in names devices safely, and steadier recordings
A reminder about a channel you can no longer open keeps its words to itself; QR sign-in never repeats a made-up device name; parts of a recording are bounded and kept in order.SecurityGated channels stay off the lock screen, sign-in takes the same time for everyone, and cleaner pages
Reminders, list items and canvas comments in an age-gated or spoiler channel say where, not what; a wrong password costs the same for every account.SecurityApps you authorised end with your sessions, sign-in links leave the address bar, and SCIM errors in SCIM’s shape
A password reset or change, Sign out everywhere, an address change and staff action end every app’s access; a mailed link’s token leaves the address bar at once; SCIM answers errors as identity providers expect.SecurityDirectory sync at its real address, a request log without secrets, and console saves that say so
SCIM provisioning answers at /api/scim/v2; the request log no longer keeps tokens; more names follow the name rule; console saves announce “Saved.”SecuritySafer names, audit lines that say where, and pictures checked on both sides of a shared channel
A workspace’s audit log records where each action came from; a name or nickname must be something people can see; a picture in a shared channel is checked when either organization asks.Security
19 October 2026
Players that fit a phone, link preview pictures checked, and GIF search for everyone
The clip mini player fits a sideways phone, the players’ times and volume work at large text and with a keyboard, a link preview’s picture is kept by Kemble and checked, and the GIF picker no longer limits a person.Security
Week of 12 October
6 releases
18 October 2026
Account security: one-time codes used once, reset notices, and tighter outbound connections
An authenticator code and a password reset link work exactly once even when sent twice at once, you get an email when your password is reset or two-step sign-in is turned off, and webhooks connect only to the address that was checked.SecurityNewcomers see only what came after them, everywhere, and videos lose where they were filmed
Where a channel withholds its earlier history, newcomers can no longer reach older threads, files, recordings or K Buddy summaries of them, and photos and videos in more formats are stored without their location.Security
17 October 2026
Other people’s words stay theirs, deleted polls go with their message, and newcomers see only what came after them
Deleting a list item or a canvas comment that holds other people’s words needs the same standing as deleting their messages, a deleted poll’s question and votes are deleted with it, and members who cannot read earlier history no longer see older polls or thread titles.Security
13 October 2026
Nobody acts above their place, and history before you joined stays before you joined
Deleting a whole thread or post, editing somebody else’s message, AutoMod’s timeouts and removing people from a private channel all need standing above everybody affected, and a channel that hides its history hides it in threads and quotes too.Security
12 October 2026
Moderators who cannot act above themselves, and badges without the people you blocked
Removing, disabling or demoting somebody needs a standing above theirs at every door, badges leave out broadcasts from people you blocked or ignore, and a directory cannot switch off the last owner.SecurityPhotos without their location, blocks that reach Activity, and typing only from people who can post
Pictures are stored without the location and camera notes a phone writes into them, Activity and the Inbox leave out people you blocked or ignore, and “is typing” comes only from somebody who may post there.Security
Week of 5 October
9 releases
11 October 2026
Notifications that respect a block, a hold and a slow website
Somebody you blocked or ignore cannot reach you with Notify anyway, a ring or an invitation, a connected organization’s hold on your phone is kept, and a slow link no longer delays anybody’s notifications.SecurityMessage people from a connected organization directly
In Kemble Work, two people from organizations that share a channel can message each other directly, once both organizations turn it on.SecurityAn invite link works only while its maker could still make it
A Kemble Work invite link stops admitting people when the person who copied it leaves, is deactivated or changes role, or when Who can invite people is tightened.Security
10 October 2026
Choose who can share a list or a canvas
In Kemble Work, Share on a list or a canvas has Who can share: anyone with access, people who can edit, or only its owner and channel managers.SecurityGuests are told when their access ends, and access logs show more
A guest with an end date reads it in their invitation and in the app, and an access log shows a sign-in again when its address or browser changes.Security
6 October 2026
Set when a guest’s access ends
In Kemble Work, owners and admins can give a guest an end date, as they invite them or later from Manage members.SecurityClearer workspace analytics and access logs
Analytics’ Overview counts the way its Members tab does, and the access log shows each sign-in once.SecurityMember analytics and access logs for Work admins
Workspace settings › Analytics shows each member’s activity over 7, 30 or 90 days, and every sign-in to the workspace in the last 90 days, to owners and admins who manage members.Security
5 October 2026
A workspace can require two-step sign-in, and sign a member out
In Kemble Work, an owner can require two-step sign-in and choose how long a session lasts, and owners and admins can sign a member out of the workspace on every device.Security
Week of 1 October
4 releases
4 October 2026
A Slack import run again goes back into the channels it made
Running the import again finds the channel an earlier run made, from the history it holds, and people are matched only by an email address they have confirmed.SecurityKemble Circle: a private category stays private
A moderator who cannot see a private category can no longer open it up, its name goes only to people who can see it, and deleting a category leaves its channels with the permissions they had.Security
2 October 2026
Pictures an app or a webhook names are kept by Kemble
A picture in an app’s or a webhook’s message, and a webhook’s own picture, is fetched once by Kemble and read from Kemble, so the sender never learns who reads the message.SecurityMaking someone an owner asks that it’s you
In Kemble Work, making someone an owner asks the acting owner to confirm with their second step or password; a Kemble Circle community changes hands only from its settings. A member made a guest no longer keeps other roles.Security