What changed

Recent hardening work included tightening how the browser's referrer header is handled so sensitive links are never leaked to external sites, rotating and re-encrypting stored secrets after a scheduled key rotation, and adding automated tests that confirm one customer's account data can never be reached through another customer's session, across dozens of routes in the product.

Why

Most security work is invisible by design — the goal is that nothing changes about your day-to-day experience, while the underlying protections get stronger. Automated tests that specifically check for cross-account access failures mean this kind of issue gets caught before it ever reaches a live account.

What you need to do

Nothing is required of you. If you ever notice anything in your account that looks like it might belong to someone else, contact Support immediately.

In detail

One more thing

Most of what's described here is the kind of work that, done well, nobody notices — which is exactly the point. A tightened referrer policy or a rotated secret doesn't change anything about how CFIN feels to use, but it closes a door that shouldn't have been open.

We treat this as continuous work rather than a single project with an end date, and we'll keep posting notable rounds of it here.

We'll keep publishing a round-up like this periodically, in plain terms, rather than only mentioning security work when something has gone wrong, since the steady, unglamorous version of this work is the one that actually matters most.