v1.3.1 — Security hardening: SSRF-safe webhook test & expiring links #
SSRF-safe webhook test — the webhook "Test" button now uses WordPress's SSRF-protected HTTP client, matching the live webhook sends.
14 Jul 2026
Release
Security hardening in 1.3.1
- SSRF-safe webhook test — the webhook "Test" button now uses WordPress's SSRF-protected HTTP client, matching the live webhook sends.
- Pro: expiring portal & contract links — client portal and contract links now expire (default 180 days, sliding — the window refreshes each time the client opens the link) instead of being permanent bearer links. Added a "Reset link" button on the client profile to revoke a shared portal link immediately. Existing links are given a bounded expiry on upgrade.