One Time Secret

Deployment Notes

PR #3618 - Defaults for Sign-in and Sign-up settings

Flips signup_enabled/signin_enabled from true to false existing custom domains. Historically these defaulted to true (from the #3023 backfill), showing "Create Account"/"Sign In" links on custom-domain homepages. This was confusing for everyone involved. The default is now OFF for new domains; this migration resets the persisted value on existing ones.

[!WARNING]
Requires a post-deploy migration command:
bin/ots migrate --run 20260703_01_disable_homepage_auth_links

Idempotent, dry-run by default (needs --run to write).

PR #3603 — CSP headers

[!WARNING]
Content Security Policy (CSP) headers are now on by default. This PR fixes an issue where the header was not being generated even though all of the inline assets were nonce-ified. So, a change in behaviour but not a change in policy.
Disable with CSP_ENABLED=false to maintain the same behaviour as v0.25.11 and earlier.

PR #3782 — Background workers

[!IMPORTANT]
Changes the default behaviour for several jobs settings, including enabling background workers by default for: favicon_fetch (new), plan_cache_refresh.enabled, catalog_retry.enabled, domain_refresh.

Flag-gated OFF (jobs.favicon_fetch), but the other three job flags flip their defaults — worth flagging in deploy notes even though this PR's own feature is off.

PR #3721 — Unify brand typography

Visible rendering change for existing custom-domain brands with no explicit font set.

[!NOTE]
We added a 4th font option: system. To make it distinct from sans, the system fonts were removed from the sans font family list. Branded pages that never picked a font now renders Helvetica/Arial instead of the OS system font. That's consistent with the determinism direction (same brand across all OSes), but it is a visible change for existing domains.

PR #3778 — Brand Packs for logos and favicons

Moves neutral brand assets from public/web/ into public/branding/default/, and introduces etc/branding/<name>/ as an operator override root shadowing public/branding/<name>/. Anyone with custom deployment overlays on the old public/web/ paths should verify against the new pack resolution order.

Nothing breaks, but the resolution order changed: public/web is now the last-ditch fallback, not the base layer:

First checks per-domain icon (Redis), then:
  ↓ BRAND_FAVICON_URL (302 redirect)
  ↓ selected brand pack (BRAND_PACK / BRAND_ASSETS_DIR)
  ↓ default brand pack (public/branding/default)
  ↓ legacy public/web mount (last-ditch fallback)

[!TIP]
Use the new BRAND_PACK build arg to in bake a custom logo and/or favicon:

docker build --build-arg BRAND_PACK=<name> .

What's Changed

[!NOTE]
Includes a fully new Colonel Admin UI.

• Add route-level error boundary to prevent blank pages on render failures https://github.com/onetimesecret/onetimesecret/pull/3618
• CSP in Otto's response layer — emit on web by default https://github.com/onetimesecret/onetimesecret/pull/3603
• Custom-domain favicon fetch worker https://github.com/onetimesecret/onetimesecret/pull/3782
• Unify branded heading typography and harden border_radius reads https://github.com/onetimesecret/onetimesecret/pull/3721
• Consolidate brand packs: resolve to default, add manifest layer https://github.com/onetimesecret/onetimesecret/pull/3778
• Add billing-payer decoupling design spec https://github.com/onetimesecret/onetimesecret/pull/3663
• Add code coverage reporting to GitHub Code Quality https://github.com/onetimesecret/onetimesecret/pull/3521
• Add Colonel admin console with comprehensive management UI https://github.com/onetimesecret/onetimesecret/pull/3679
• Add configurable email signature name (BRAND_SIGNATURE_NAME) https://github.com/onetimesecret/onetimesecret/pull/3406
• Add configurable secret content size limit https://github.com/onetimesecret/onetimesecret/pull/3676
• Add Configuration Generator JSON API (UI lives in the docs site) https://github.com/onetimesecret/onetimesecret/pull/3644
• Add contract tests for governance derive script pin management https://github.com/onetimesecret/onetimesecret/pull/3565
• Add custom mail sender provider docs https://github.com/onetimesecret/onetimesecret/pull/3816
• Add email templates for security, account, and billing notifications https://github.com/onetimesecret/onetimesecret/pull/3706
• Add gitignore files for e2e and locales/db directories https://github.com/onetimesecret/onetimesecret/pull/3515
• Add incoming secrets mode to custom domain homepage selector https://github.com/onetimesecret/onetimesecret/pull/3628
• Add macOS companion design specification https://github.com/onetimesecret/onetimesecret/pull/3675
• Add missing UI/branding env vars to reference https://github.com/onetimesecret/onetimesecret/pull/3364
• Add optional pack-carried masthead logo support (#3774) https://github.com/onetimesecret/onetimesecret/pull/3793
• Add post-signup email verification confirmation page https://github.com/onetimesecret/onetimesecret/pull/3626
• Add pr-per-locale.sh script for automated i18n PR creation https://github.com/onetimesecret/onetimesecret/pull/3573
• Add preflight validation and improve error handling https://github.com/onetimesecret/onetimesecret/pull/3507
• Add README for visual regression testing https://github.com/onetimesecret/onetimesecret/pull/3735
• Add request_id correlation to error responses (#3520) https://github.com/onetimesecret/onetimesecret/pull/3559
• Add self-service verification email resend endpoint https://github.com/onetimesecret/onetimesecret/pull/3552
• Add spec/api lane, doc db-agnostic contract, restore email-logo gate https://github.com/onetimesecret/onetimesecret/pull/3365
• Add support for domain validation UI for multiple strategies https://github.com/onetimesecret/onetimesecret/pull/3623
• Add upstream MR runbook for oauth_mount_prefix fix https://github.com/onetimesecret/onetimesecret/pull/3554
• Add validate-register CI gate for governed locale content (translation-rules P1-4b minimal slice) https://github.com/onetimesecret/onetimesecret/pull/3432
• ADR-030 config layering + custom-domain auth defaults OFF https://github.com/onetimesecret/onetimesecret/pull/3783
• Align Rodauth hook docs and layout with last-writer-wins semantics https://github.com/onetimesecret/onetimesecret/pull/3804
• Align V1 receipt endpoint with V2/V3 reveal rules for secrets https://github.com/onetimesecret/onetimesecret/pull/3664
• bin/setup: rev-stamped .envrc generation + earlier doctor checks https://github.com/onetimesecret/onetimesecret/pull/3772
• Bind incoming secrets to custom domain and update email layout branding https://github.com/onetimesecret/onetimesecret/pull/3617
• Brand Manager: three-path editor with expanded token vocabulary https://github.com/onetimesecret/onetimesecret/pull/3714
• Brand token consumers + ADR-024 auth overrides + staged image commit https://github.com/onetimesecret/onetimesecret/pull/3720
• branding: rename neutral default product name 'My App' → 'Secure Links' https://github.com/onetimesecret/onetimesecret/pull/3572
• build: generate JSON schemas during pnpm build so they ship in the image https://github.com/onetimesecret/onetimesecret/pull/3563
• Cap generated-password length on v1+v2 generate endpoints (C5 DoS) https://github.com/onetimesecret/onetimesecret/pull/3809
• chore: colocate JSON-schema generator under src/schemas (drop build-stage COPY scripts) https://github.com/onetimesecret/onetimesecret/pull/3564
• chore: documentation tidying and config string-key fixes https://github.com/onetimesecret/onetimesecret/pull/3624
• chore: stop copying scripts/ into the runtime image https://github.com/onetimesecret/onetimesecret/pull/3607
• ci(C7 2a): compose-smoke lane + app healthcheck (CP-11) https://github.com/onetimesecret/onetimesecret/pull/3712
• ci(C7 2b): installer matrix + run.sh container harness https://github.com/onetimesecret/onetimesecret/pull/3713
• ci(C7): fresh-clone contributor lane + docs-command drift guard https://github.com/onetimesecret/onetimesecret/pull/3711
• ci(claude): configurable model selection with fallback (develop) https://github.com/onetimesecret/onetimesecret/pull/3512
• ci(claude): configurable model selection with fallback (main) https://github.com/onetimesecret/onetimesecret/pull/3511
• ci(i18n): decouple translation-rules data ref from the derive action pin (variable + dispatch override) https://github.com/onetimesecret/onetimesecret/pull/3541
• ci(i18n): tolerate quoted TRANSLATION_RULES_REF in Renovate customManager https://github.com/onetimesecret/onetimesecret/pull/3543
• ci: pin Claude model to claude-sonnet-4-6 on default branch https://github.com/onetimesecret/onetimesecret/pull/3506
• ci: skip CodeQL + Claude review on locale-only PRs; fix stale locale-script refs https://github.com/onetimesecret/onetimesecret/pull/3611
• Clean up nil-valued headers left by IPPrivacyMiddleware https://github.com/onetimesecret/onetimesecret/pull/3522
• CLI customers suspend/unsuspend/plan-set over Operations (P1 of #3731) https://github.com/onetimesecret/onetimesecret/pull/3734
• Colonel admin: org detail/reconcile, sessions decrypt, banner audience scope, TTL persistence https://github.com/onetimesecret/onetimesecret/pull/3707
• Complete Tailwind v4 CSS-first migration on develop (remove tailwind.config.ts) https://github.com/onetimesecret/onetimesecret/pull/3410
• config: align notifications worker prefetch default (10 → 5) https://github.com/onetimesecret/onetimesecret/pull/3779
• config: inline JOBS_* defaults, prune 32 dead env vars https://github.com/onetimesecret/onetimesecret/pull/3777
• Consolidate brand identity resolution to prevent OTS branding leaks https://github.com/onetimesecret/onetimesecret/pull/3568
• Consolidate brand identity to single authority (#3612) https://github.com/onetimesecret/onetimesecret/pull/3622
• Consolidate branding on manifest pipeline; fix CTA color and logo override https://github.com/onetimesecret/onetimesecret/pull/3781
• Consolidate schema docs around target architecture https://github.com/onetimesecret/onetimesecret/pull/3684
• Correlate API error responses with logs via request_id https://github.com/onetimesecret/onetimesecret/pull/3518
• Degrade bootstrap to free tier on plan catalog miss instead of 503 https://github.com/onetimesecret/onetimesecret/pull/3818
• Dependency updates: Ruby gems + npm security overrides https://github.com/onetimesecret/onetimesecret/pull/3805
• Dev installers: link .env to .env.example, load .env.local overrides https://github.com/onetimesecret/onetimesecret/pull/3368
• Developer onboarding: install/boot fixes, version pins, and clean-room CI https://github.com/onetimesecret/onetimesecret/pull/3715
• docs(adr): ADR authoring guidance — splitting vs. combining decisions https://github.com/onetimesecret/onetimesecret/pull/3699
• docs(adr): ADR-021 audit-log terminology & event-stream scoping https://github.com/onetimesecret/onetimesecret/pull/3698
• docs(domain-validation): promote ADR-015..018 to accepted https://github.com/onetimesecret/onetimesecret/pull/3661
• docs(entitlements): prepare full separation of plan entitlements from role capabilities (#3491) https://github.com/onetimesecret/onetimesecret/pull/3546
• docs(security): add security audit reports https://github.com/onetimesecret/onetimesecret/pull/3797
• docs: Add #3424 disclosure matrix and UX analysis specs https://github.com/onetimesecret/onetimesecret/pull/3528
• docs: add accessibility audit for public surfaces (2026-07-04) https://github.com/onetimesecret/onetimesecret/pull/3634
• docs: add design spec for schema validation and boundary enforcement https://github.com/onetimesecret/onetimesecret/pull/3514
• docs: add Email Quality Controls epic specification https://github.com/onetimesecret/onetimesecret/pull/3682
• docs: add install & onboarding problem space assessment https://github.com/onetimesecret/onetimesecret/pull/3638
• docs: Add install onboarding audit, testing strategy, and work plan https://github.com/onetimesecret/onetimesecret/pull/3704
• docs: add schema complexity verdict and reduction plan https://github.com/onetimesecret/onetimesecret/pull/3652
• docs: ADR-026..029 — brand pack layering, nil invariant, root split https://github.com/onetimesecret/onetimesecret/pull/3776
• docs: clarify email-quality-controls epic scope and retire schedule_email https://github.com/onetimesecret/onetimesecret/pull/3685
• docs: Colonel Admin Rebuild spec set (epic #3653) https://github.com/onetimesecret/onetimesecret/pull/3660
• docs: domain-validation ADR set, spec re-homing, and reference fixes https://github.com/onetimesecret/onetimesecret/pull/3656
• Domains remove Operation + colonel & CLI adapters (P3 of #3731) https://github.com/onetimesecret/onetimesecret/pull/3737
• E2E Phase 1: fix reporter/artifact pipeline, lint-ban flaky waits, gate retry-only passes https://github.com/onetimesecret/onetimesecret/pull/3411
• E2E Phase 2.1+2.2: auth via setup project + storageState, deterministic app-readiness signal https://github.com/onetimesecret/onetimesecret/pull/3412
• E2E Phase 2.3: networkidle/sleep sweep, lint rules to error https://github.com/onetimesecret/onetimesecret/pull/3416
• E2E: Phase 2.4 defensive-skip triage — env gates + quarantine https://github.com/onetimesecret/onetimesecret/pull/3425
• Enable XChaCha20-Poly1305 encryption with libsodium and audit DPA compliance https://github.com/onetimesecret/onetimesecret/pull/3616
• Expand brand customization with secondary colors, fonts, border radius, and presets (#3646) https://github.com/onetimesecret/onetimesecret/pull/3671
• Extract email defaults logic and localize no-reply placeholder https://github.com/onetimesecret/onetimesecret/pull/3567
• Fail closed on unrecognized secrets_mode to prevent form exposure https://github.com/onetimesecret/onetimesecret/pull/3636
• feat(admin): colonel domain attach, email tools, and deliverability visibility https://github.com/onetimesecret/onetimesecret/pull/3709
• feat(admin): flag colonel's own session + revoke_for_customer hardening https://github.com/onetimesecret/onetimesecret/pull/3806
• Harden error logging to prevent query strings and secrets in logs https://github.com/onetimesecret/onetimesecret/pull/3629
• Harden Sentry diagnostics scrubbing (FE + BE) https://github.com/onetimesecret/onetimesecret/pull/3796
• Harden Sentry scrub coverage and bind isolated diagnostics client https://github.com/onetimesecret/onetimesecret/pull/3788
• Harden Sentry scrub tiers: promote scrub_url, fix ID-net anchoring, scope tags, transaction route https://github.com/onetimesecret/onetimesecret/pull/3795
• Harmonize IP / trusted-proxy handling via otto 2.3.1 https://github.com/onetimesecret/onetimesecret/pull/3504
• Hide "One specific mode" option and grant_org_scope pending testing https://github.com/onetimesecret/onetimesecret/pull/3786
• Implement Secure Customer Session Metadata and Bulk Revocation https://github.com/onetimesecret/onetimesecret/pull/3710
• Improve invitation status display with expiry-aware logic https://github.com/onetimesecret/onetimesecret/pull/3790
• Improve Ruby/Node setup and Playwright sandbox compatibility https://github.com/onetimesecret/onetimesecret/pull/3695
• install-dev.sh: route .env through shared dotenv-main symlink https://github.com/onetimesecret/onetimesecret/pull/3513
• install-test.sh: parse PostgreSQL maintenance URL with URI to preserve query params https://github.com/onetimesecret/onetimesecret/pull/3555
• integration/main into develop https://github.com/onetimesecret/onetimesecret/pull/3380
• Integration: base-main-to-develop — i18n CLI consolidation https://github.com/onetimesecret/onetimesecret/pull/3475
• Integration: i18n CLI consolidation (i18n/base-main → develop) https://github.com/onetimesecret/onetimesecret/pull/3473
• Integration: main into develop — i18n test migration & conflict resolution https://github.com/onetimesecret/onetimesecret/pull/3497
• Integration: merge main into develop (v0.26.0 release prep) https://github.com/onetimesecret/onetimesecret/pull/3524
• Integration: merge main into develop https://github.com/onetimesecret/onetimesecret/pull/3471
• Locale schema refinement and brand_product_name wiring https://github.com/onetimesecret/onetimesecret/pull/3056
• Make favicon generator reusable with presets and custom overrides https://github.com/onetimesecret/onetimesecret/pull/3570
• Make GET endpoints safe: record access telemetry instead of mutating state https://github.com/onetimesecret/onetimesecret/pull/3635
• Make test setup runnable on a fresh clone (install-test.sh + rspec from rubygems) https://github.com/onetimesecret/onetimesecret/pull/3551
• Make the global auth kill switch authoritative over per-domain sign-in/sign-up configs https://github.com/onetimesecret/onetimesecret/pull/3453
• Make TOTP issuer configurable via brand settings https://github.com/onetimesecret/onetimesecret/pull/3393
• Memberships add/remove/set-role Operations + colonel & CLI adapters (P2 of #3731) https://github.com/onetimesecret/onetimesecret/pull/3736
• Move brand config normalization from YAML to Ruby https://github.com/onetimesecret/onetimesecret/pull/3609
• Move login rate-limit check ahead of argon2 comparison https://github.com/onetimesecret/onetimesecret/pull/3807
• Move macOS companion spec to dedicated repository https://github.com/onetimesecret/onetimesecret/pull/3681
• Neutral favicon + mobile/social variety pack (build-time & install-time branding) https://github.com/onetimesecret/onetimesecret/pull/3472
• Onboarding C6-C10: bin/setup, devcontainer/CI lanes, SECRET lifecycle safety https://github.com/onetimesecret/onetimesecret/pull/3719
• Per-domain auth config — backend slice + test coverage https://github.com/onetimesecret/onetimesecret/pull/3395
• Per-domain sign-in disable: expressible control + friendly 'unavailable' page https://github.com/onetimesecret/onetimesecret/pull/3417
• Phase 2.3–2.4: E2E remediation, signin config, branding, and auth improvements https://github.com/onetimesecret/onetimesecret/pull/3519
• Port brand bootstrapping and test coverage from closed PR #3054 https://github.com/onetimesecret/onetimesecret/pull/3355
• Port branding system: 3-tier fallback, WCAG validation, neutral defaults https://github.com/onetimesecret/onetimesecret/pull/3354
• Post-merge follow-ups from incoming refinements (#3666) https://github.com/onetimesecret/onetimesecret/pull/3687
• pr-per-locale.sh: strip leaked agent preamble from review output https://github.com/onetimesecret/onetimesecret/pull/3605
• Promote v0.26 https://github.com/onetimesecret/onetimesecret/pull/3525
• Quarantine invitation fixture tests and env-gate custom domain suite https://github.com/onetimesecret/onetimesecret/pull/3526
• Rebuild Brand Manager as three-path editor; align domain headers https://github.com/onetimesecret/onetimesecret/pull/3694
• Redesign colonel admin console as Operations Ledger https://github.com/onetimesecret/onetimesecret/pull/3705
• Redesign domain sign-in config: SSO modal + two-mode availability UI https://github.com/onetimesecret/onetimesecret/pull/3413
• Reduce redundant HomepageConfig reads in domain validation https://github.com/onetimesecret/onetimesecret/pull/3665
• Refactor domain add/manage UX based on custom domain count https://github.com/onetimesecret/onetimesecret/pull/3627
• Refactor scope switchers to use shared ScopeSwitcher engine https://github.com/onetimesecret/onetimesecret/pull/3658
• refactor(branding): route the masthead logo image through the resolver (Phase 4) https://github.com/onetimesecret/onetimesecret/pull/3569
• refactor(security): non-CSP #3498 hardening — YAML safe-load Date/Time + CLI regression coverage https://github.com/onetimesecret/onetimesecret/pull/3561
• refactor: declarative text_layout DSL + shared useHeaderEnabled composable https://github.com/onetimesecret/onetimesecret/pull/3444
• Remove default_mode feature and clean up config/docs https://github.com/onetimesecret/onetimesecret/pull/3389
• Remove redundant brand_totp_issuer now the backend owns the QR (issue #3431) https://github.com/onetimesecret/onetimesecret/pull/3439
• Remove the inert CodeQL advanced-setup workflow and config https://github.com/onetimesecret/onetimesecret/pull/3619
• Remove unused mustache gem; pin unpinned deps; amend ADR-001 https://github.com/onetimesecret/onetimesecret/pull/3819
• Reorganize colonel schemas and implement Phase-3 admin features https://github.com/onetimesecret/onetimesecret/pull/3688
• Replace CSS class selectors with test IDs in E2E tests https://github.com/onetimesecret/onetimesecret/pull/3490
• Request-scoped entitlement preview for colonels https://github.com/onetimesecret/onetimesecret/pull/3683
• Runtime brand-asset overlay (BRAND_PACK / BRAND_ASSETS_DIR) https://github.com/onetimesecret/onetimesecret/pull/3770
• Scaffold admin_v2: isolated Colonel console bundle with phase-0 overview https://github.com/onetimesecret/onetimesecret/pull/3673
• Scaffold test lanes for local dev ⟷ CI parity https://github.com/onetimesecret/onetimesecret/pull/3430
• Secret Activity: actor identity on lifecycle events (revealed/burned) https://github.com/onetimesecret/onetimesecret/pull/3696
• Secret Activity: capture request context (IP / user agent) with an explicit privacy stance https://github.com/onetimesecret/onetimesecret/pull/3697
• Security audit 2026-07-06: high & medium severity remediations https://github.com/onetimesecret/onetimesecret/pull/3803
• Security audit 2026-07-06: LOW remediation https://github.com/onetimesecret/onetimesecret/pull/3811
• Security hardening: session deserialization, CSP, shell-exec, and YAML loaders https://github.com/onetimesecret/onetimesecret/pull/3500
• Seed domain signin/signup settings from the default-off custom-domain resolver (#3814) https://github.com/onetimesecret/onetimesecret/pull/3817
• Slice 4 — Phase-2 admin parity screens (secrets, domains, orgs, system/banned-ips/usage) https://github.com/onetimesecret/onetimesecret/pull/3677
• Slice 5 — Phase-3 CLI-only powers as UI + ops extraction (40/41/42/43/44/45) https://github.com/onetimesecret/onetimesecret/pull/3678
• Slice 6 — Cutover & hardening: retire old colonel app, CIDR isolation, impersonation audit (50/51/52) https://github.com/onetimesecret/onetimesecret/pull/3680
• Small refinements to Incoming Secrets settings UI* https://github.com/onetimesecret/onetimesecret/pull/3666
• Speed up pre-commit and pre-push hooks https://github.com/onetimesecret/onetimesecret/pull/3718
• Stop backfilling brand_primary_color default at serialization time https://github.com/onetimesecret/onetimesecret/pull/3397
• test(a11y): authenticated-surface coverage + enforcement policy docs https://github.com/onetimesecret/onetimesecret/pull/3645
• test(a11y): scan interactive states (dropdown, error banner, modal) https://github.com/onetimesecret/onetimesecret/pull/3657
• Unify mail domain vocabulary: brand_* for links, display_domain for labels https://github.com/onetimesecret/onetimesecret/pull/3620
• Update AddDomain flow to helpfully suggest alternatives to an apex domain https://github.com/onetimesecret/onetimesecret/pull/3686
• Update GA workflows for Ruby 3.4.10 https://github.com/onetimesecret/onetimesecret/pull/3802
• Update Node.js to 5647be7 https://github.com/onetimesecret/onetimesecret/pull/3791
• Update rabbitmq:4.2-management Docker digest to 2f5f2d5 https://github.com/onetimesecret/onetimesecret/pull/3792
• Update visual regression baselines for v0.26.0 (again after #3786) https://github.com/onetimesecret/onetimesecret/pull/3789
• Update visual regression baselines for v0.26.0 https://github.com/onetimesecret/onetimesecret/pull/3785
• Use SecureRandom for all randomness in generated-secret password generation https://github.com/onetimesecret/onetimesecret/pull/3452
• Use UUID idempotency keys for checkout session creation https://github.com/onetimesecret/onetimesecret/pull/3690
• Visual regression archive: PR artifacts + OCI releases for cross-version diffs (PR 3/3) https://github.com/onetimesecret/onetimesecret/pull/3725
• Visual regression CI lane: workflow, env pinning, version-string mask (PR 2/3) https://github.com/onetimesecret/onetimesecret/pull/3723
• Visual regression suite: Playwright projects, fixture seeding, bin/visual runner (PR 1/3) https://github.com/onetimesecret/onetimesecret/pull/3722
• Visual regression: sticky PR summary comment + PR-render archive https://github.com/onetimesecret/onetimesecret/pull/3726
• Wave 1 foundation: brand-token consumers, schema hygiene, backend round-trips https://github.com/onetimesecret/onetimesecret/pull/3716

Fixes

• Fix #3424: surface failing schema fields and coerce receipt timestamps https://github.com/onetimesecret/onetimesecret/pull/3517
• Fix brand head-base E2E failure (conditional render) + E2E remediation plan https://github.com/onetimesecret/onetimesecret/pull/3409
• Fix branding defaults and sender config normalization https://github.com/onetimesecret/onetimesecret/pull/3553
• Fix CI failures on the 2026-07-06 audit branch https://github.com/onetimesecret/onetimesecret/pull/3808
• Fix double-reveal race on burn-after-reading secrets with atomic CAS https://github.com/onetimesecret/onetimesecret/pull/3615
• Fix e2e tests for updated invite flow UI and API endpoints https://github.com/onetimesecret/onetimesecret/pull/3448
• Fix ESLint flat-config negated-files scoping, unmasked max-len violations, and Tailwind plugin crash https://github.com/onetimesecret/onetimesecret/pull/3414
• Fix login alert emails queued with empty locale https://github.com/onetimesecret/onetimesecret/pull/3815
• Fix MFA QR code to encode correct HMAC secret (issue #3431) [develop] https://github.com/onetimesecret/onetimesecret/pull/3438
• Fix NoMethodError in UpdateLocale for anonymous users (#3516) https://github.com/onetimesecret/onetimesecret/pull/3562
• Fix org context switcher hidden for paid solo-default workspaces https://github.com/onetimesecret/onetimesecret/pull/3703
• Fix Playwright strict mode violations in e2e tests https://github.com/onetimesecret/onetimesecret/pull/3501
• Fix primaryColor fallback chain to include install config (#3381) https://github.com/onetimesecret/onetimesecret/pull/3387
• Fix race conditions in email suppression and recipient handling https://github.com/onetimesecret/onetimesecret/pull/3689
• Fix remaining #3362 env vars: HEADER_ENABLED landmark + BRAND_SUPPORT_EMAIL plaintext https://github.com/onetimesecret/onetimesecret/pull/3422
• Fix stale CLI paths in translation docs and help text https://github.com/onetimesecret/onetimesecret/pull/3728
• Fix TOTP issuer inconsistencies and wire up brand_totp_issuer config https://github.com/onetimesecret/onetimesecret/pull/3399
• Fix UI issues https://github.com/onetimesecret/onetimesecret/pull/3382
• fix(a11y): make scope-switcher row a div to avoid nested buttons https://github.com/onetimesecret/onetimesecret/pull/3659
• fix(branding): stop brand logo from duplicating the custom-domain header https://github.com/onetimesecret/onetimesecret/pull/3670
• fix(branding): stop GLOBAL_DEFAULTS[:product_name] leaking 'OTS' https://github.com/onetimesecret/onetimesecret/pull/3556
• Fix(ci): use a distinct fallback model for Claude workflows https://github.com/onetimesecret/onetimesecret/pull/3527
• fix(config): make install-level auth/incoming flags canonical-only for custom domains https://github.com/onetimesecret/onetimesecret/pull/3669
• fix(jobs): sync email fallback no longer 500s on delivery failure https://github.com/onetimesecret/onetimesecret/pull/3545
• fix(nav): close scope-switcher dropdowns after navigation (domain + org) https://github.com/onetimesecret/onetimesecret/pull/3654
• fix(receipt): guard state transitions with atomic CAS to stop TTL-evicted resurrection (#3625) https://github.com/onetimesecret/onetimesecret/pull/3674
• fix(receipt): stop GET from mutating secret state; make creator reveal once-only (#3633) https://github.com/onetimesecret/onetimesecret/pull/3668
• fix: developer onboarding — install, boot, systemd, and version pinning https://github.com/onetimesecret/onetimesecret/pull/3708

Translations

Full translation updates for all locales.

• [#I18N] Add per-locale branch automation script https://github.com/onetimesecret/onetimesecret/pull/3502
• [#I18N] Consolidate i18n translation tooling: .resolved vendoring, freshness gate, CLI concurrency https://github.com/onetimesecret/onetimesecret/pull/3523
• [#I18N] Slash commands → orchestration-only; CLI owns concurrency; .resolved vendoring https://github.com/onetimesecret/onetimesecret/pull/3503
• [i18n] Fix source-side (en/) locale defects from the 2026-07-01 review wave https://github.com/onetimesecret/onetimesecret/pull/3730
• [i18n] Replace raw %{status} enum in invite errors with per-status keys https://github.com/onetimesecret/onetimesecret/pull/3732
• [i18n] session_log CLI helper + documented drain→export→PR pipeline https://github.com/onetimesecret/onetimesecret/pull/3738
• i18n content hashes: default to dry-run with rewrite safety gate https://github.com/onetimesecret/onetimesecret/pull/3608
• i18n tooling: export-all.sh + pipeline docs + db regen https://github.com/onetimesecret/onetimesecret/pull/3740
• i18n-arch: no-vendor migration — regenerate-in-CI derive gate (#36, #3510, #38) https://github.com/onetimesecret/onetimesecret/pull/3531
• i18n-arch: no-vendor migration — remove vendored corpus + derive on demand (#3510) https://github.com/onetimesecret/onetimesecret/pull/3532
• i18n: 0613 pass1 — locale hash corrections + tooling cleanup https://github.com/onetimesecret/onetimesecret/pull/3461
• i18n: 0613 pass2 — locale translations + scripts cleanup https://github.com/onetimesecret/onetimesecret/pull/3462
• i18n: 0613 pass3 — consolidate locale tooling into unified i18n CLI (stacked on #3462) https://github.com/onetimesecret/onetimesecret/pull/3463
• i18n: batch locale updates (supersedes #3574–#3602) https://github.com/onetimesecret/onetimesecret/pull/3613
• i18n: batch locale updates (supersedes #3574–#3602) https://github.com/onetimesecret/onetimesecret/pull/3773
• i18n: enforce register gate across all governed locales via resolver engine https://github.com/onetimesecret/onetimesecret/pull/3537
• i18n: pr-per-locale.sh — diagnostics capture + --skip-validation https://github.com/onetimesecret/onetimesecret/pull/3771
• i18n: remove orphaned email.email_changed.body key (fixes stray %{date}) https://github.com/onetimesecret/onetimesecret/pull/3604
• i18n: translate 'Secret Support' sign-off + reconcile workspace labels (29 locales) https://github.com/onetimesecret/onetimesecret/pull/3729
• i18n: translation staleness detection + workflow doc cleanup https://github.com/onetimesecret/onetimesecret/pull/3724
• i18n: update ar translations https://github.com/onetimesecret/onetimesecret/pull/3574
• i18n: update ar translations https://github.com/onetimesecret/onetimesecret/pull/3741
• i18n: update bg translations https://github.com/onetimesecret/onetimesecret/pull/3575
• i18n: update bg translations https://github.com/onetimesecret/onetimesecret/pull/3742
• i18n: update ca_ES translations https://github.com/onetimesecret/onetimesecret/pull/3576
• i18n: update ca_ES translations https://github.com/onetimesecret/onetimesecret/pull/3743
• i18n: update cs translations https://github.com/onetimesecret/onetimesecret/pull/3577
• i18n: update cs translations https://github.com/onetimesecret/onetimesecret/pull/3744
• i18n: update da_DK translations https://github.com/onetimesecret/onetimesecret/pull/3578
• i18n: update da_DK translations https://github.com/onetimesecret/onetimesecret/pull/3745
• i18n: update de translations https://github.com/onetimesecret/onetimesecret/pull/3579
• i18n: update de translations https://github.com/onetimesecret/onetimesecret/pull/3746
• i18n: update de_AT translations https://github.com/onetimesecret/onetimesecret/pull/3580
• i18n: update de_AT translations https://github.com/onetimesecret/onetimesecret/pull/3747
• i18n: update el_GR translations https://github.com/onetimesecret/onetimesecret/pull/3581
• i18n: update el_GR translations https://github.com/onetimesecret/onetimesecret/pull/3748
• i18n: update eo translations https://github.com/onetimesecret/onetimesecret/pull/3582
• i18n: update eo translations https://github.com/onetimesecret/onetimesecret/pull/3749
• i18n: update es translations https://github.com/onetimesecret/onetimesecret/pull/3583
• i18n: update es translations https://github.com/onetimesecret/onetimesecret/pull/3750
• i18n: update fr_CA translations https://github.com/onetimesecret/onetimesecret/pull/3584
• i18n: update fr_CA translations https://github.com/onetimesecret/onetimesecret/pull/3751
• i18n: update fr_FR translations https://github.com/onetimesecret/onetimesecret/pull/3585
• i18n: update fr_FR translations https://github.com/onetimesecret/onetimesecret/pull/3752
• i18n: update he translations https://github.com/onetimesecret/onetimesecret/pull/3586
• i18n: update he translations https://github.com/onetimesecret/onetimesecret/pull/3753
• i18n: update hu translations https://github.com/onetimesecret/onetimesecret/pull/3587
• i18n: update hu translations https://github.com/onetimesecret/onetimesecret/pull/3754
• i18n: update it_IT translations https://github.com/onetimesecret/onetimesecret/pull/3588
• i18n: update it_IT translations https://github.com/onetimesecret/onetimesecret/pull/3755
• i18n: update ja translations https://github.com/onetimesecret/onetimesecret/pull/3589
• i18n: update ja translations https://github.com/onetimesecret/onetimesecret/pull/3756
• i18n: update ko translations https://github.com/onetimesecret/onetimesecret/pull/3590
• i18n: update ko translations https://github.com/onetimesecret/onetimesecret/pull/3757
• i18n: update mi_NZ translations https://github.com/onetimesecret/onetimesecret/pull/3591
• i18n: update mi_NZ translations https://github.com/onetimesecret/onetimesecret/pull/3758
• i18n: update nl translations https://github.com/onetimesecret/onetimesecret/pull/3592
• i18n: update nl translations https://github.com/onetimesecret/onetimesecret/pull/3759
• i18n: update pl translations https://github.com/onetimesecret/onetimesecret/pull/3593
• i18n: update pl translations https://github.com/onetimesecret/onetimesecret/pull/3760
• i18n: update pt_BR translations https://github.com/onetimesecret/onetimesecret/pull/3594
• i18n: update pt_BR translations https://github.com/onetimesecret/onetimesecret/pull/3761
• i18n: update pt_PT translations https://github.com/onetimesecret/onetimesecret/pull/3595
• i18n: update pt_PT translations https://github.com/onetimesecret/onetimesecret/pull/3762
• i18n: update ru translations https://github.com/onetimesecret/onetimesecret/pull/3596
• i18n: update ru translations https://github.com/onetimesecret/onetimesecret/pull/3763
• i18n: update sl_SI translations https://github.com/onetimesecret/onetimesecret/pull/3597
• i18n: update sl_SI translations https://github.com/onetimesecret/onetimesecret/pull/3764
• i18n: update sv_SE translations https://github.com/onetimesecret/onetimesecret/pull/3598
• i18n: update sv_SE translations https://github.com/onetimesecret/onetimesecret/pull/3765
• i18n: update tr translations https://github.com/onetimesecret/onetimesecret/pull/3599
• i18n: update tr translations https://github.com/onetimesecret/onetimesecret/pull/3766
• i18n: update uk translations https://github.com/onetimesecret/onetimesecret/pull/3600
• i18n: update uk translations https://github.com/onetimesecret/onetimesecret/pull/3767
• i18n: update vi translations https://github.com/onetimesecret/onetimesecret/pull/3601
• i18n: update vi translations https://github.com/onetimesecret/onetimesecret/pull/3768
• i18n: update zh translations https://github.com/onetimesecret/onetimesecret/pull/3602
• i18n: update zh translations https://github.com/onetimesecret/onetimesecret/pull/3769

Dependencies

• chore(deps-dev): bump yard from 0.9.42 to 0.9.44 in the bundler group across 1 directory by @dependabot[bot] in https://github.com/onetimesecret/onetimesecret/pull/3549
• chore(deps): update actions/github-script action to v7.1.0 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3535
• chore(deps): update actions/setup-node action to v6.4.0 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3538
• chore(deps): update dependency @eslint/plugin-kit to ^0.7.0 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3539
• fix(deps): update dependency brace-expansion to v1.1.15 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3533
• Update actions/cache action to v5.1.0 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3801
• Update actions/checkout action to v6.0.3 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3701
• Update dependency eslint-plugin-tailwindcss to v4.0.4 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3702
• Update dependency eslint-plugin-tailwindcss to v4.0.6 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3798
• Update dependency mail to v2.9.1 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3799
• Update dependency ruby to v3.4.10 by @renovate[bot] in https://github.com/onetimesecret/onetimesecret/pull/3800

Full Changelog: https://github.com/onetimesecret/onetimesecret/compare/v0.25.11...v0.26.0