One Time Secret

[!IMPORTANT]
Relies on a new env var ACCOUNT_ID_SECRET to obfuscates numeric account IDs in email-verification links and remember-me cookies. Boot-contract change: now raises ConfigurationError if missing in production (≥32 bytes).

New installs can run rake ots:secrets; existing .env files, can re-run it.

What's Changed

• Add upstream MR runbook for oauth_mount_prefix fix by @delano in https://github.com/onetimesecret/onetimesecret/pull/3554
• Make test setup runnable on a fresh clone (install-test.sh + rspec from rubygems) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3551
• fix(branding): stop GLOBAL_DEFAULTS[:product_name] leaking 'OTS' by @delano in https://github.com/onetimesecret/onetimesecret/pull/3556
• Add self-service verification email resend endpoint by @delano in https://github.com/onetimesecret/onetimesecret/pull/3552
• [#3486] fix(jobs): sync email fallback no longer 500s on delivery failure by @delano in https://github.com/onetimesecret/onetimesecret/pull/3545
• Fix branding defaults and sender config normalization by @delano in https://github.com/onetimesecret/onetimesecret/pull/3553
• Add request_id correlation to error responses (#3520) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3559
• refactor(security): non-CSP #3498 hardening — YAML safe-load Date/Time + CLI regression coverage by @delano in https://github.com/onetimesecret/onetimesecret/pull/3561
• install-test.sh: parse PostgreSQL maintenance URL with URI to preserve query params by @delano in https://github.com/onetimesecret/onetimesecret/pull/3555
• Fix NoMethodError in UpdateLocale for anonymous users (#3516) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3562
• chore: colocate JSON-schema generator under src/schemas (drop build-stage COPY scripts) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3564
• Add contract tests for governance derive script pin management by @delano in https://github.com/onetimesecret/onetimesecret/pull/3565
• Extract email defaults logic and localize no-reply placeholder by @delano in https://github.com/onetimesecret/onetimesecret/pull/3567
• refactor(branding): route the masthead logo image through the resolver (Phase 4) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3569
• Make favicon generator reusable with presets and custom overrides by @delano in https://github.com/onetimesecret/onetimesecret/pull/3570
• build: generate JSON schemas during pnpm build so they ship in the image by @delano in https://github.com/onetimesecret/onetimesecret/pull/3563
• Consolidate brand identity resolution to prevent OTS branding leaks by @delano in https://github.com/onetimesecret/onetimesecret/pull/3568
• Add pr-per-locale.sh script for automated i18n PR creation by @delano in https://github.com/onetimesecret/onetimesecret/pull/3573
• branding: rename neutral default product name 'My App' → 'Secure Links' by @delano in https://github.com/onetimesecret/onetimesecret/pull/3572
• i18n: remove orphaned email.email_changed.body key (fixes stray %{date}) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3604
• chore: stop copying scripts/ into the runtime image by @delano in https://github.com/onetimesecret/onetimesecret/pull/3607
• pr-per-locale.sh: strip leaked agent preamble from review output by @delano in https://github.com/onetimesecret/onetimesecret/pull/3605
• i18n content hashes: default to dry-run with rewrite safety gate by @delano in https://github.com/onetimesecret/onetimesecret/pull/3608
• Move brand config normalization from YAML to Ruby by @delano in https://github.com/onetimesecret/onetimesecret/pull/3609
• ci: skip CodeQL + Claude review on locale-only PRs; fix stale locale-script refs by @delano in https://github.com/onetimesecret/onetimesecret/pull/3611
• i18n: batch locale updates (supersedes #3574–#3602) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3613
• i18n: update ar translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3574
• i18n: update bg translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3575
• i18n: update ca_ES translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3576
• i18n: update cs translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3577
• i18n: update da_DK translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3578
• i18n: update de translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3579
• i18n: update de_AT translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3580
• i18n: update el_GR translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3581
• i18n: update eo translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3582
• i18n: update es translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3583
• i18n: update fr_CA translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3584
• i18n: update fr_FR translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3585
• i18n: update he translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3586
• i18n: update hu translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3587
• i18n: update it_IT translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3588
• i18n: update ja translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3589
• i18n: update ko translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3590
• i18n: update mi_NZ translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3591
• i18n: update nl translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3592
• i18n: update pl translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3593
• i18n: update pt_BR translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3594
• i18n: update pt_PT translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3595
• i18n: update ru translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3596
• i18n: update sl_SI translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3597
• i18n: update sv_SE translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3598
• i18n: update tr translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3599
• i18n: update uk translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3600
• i18n: update vi translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3601
• i18n: update zh translations by @delano in https://github.com/onetimesecret/onetimesecret/pull/3602
• docs(entitlements): prepare full separation of plan entitlements from role capabilities (#3491) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3546
• • Add route-level error boundary to prevent blank pages on render failures by @delano in https://github.com/onetimesecret/onetimesecret/pull/3618
• Unify mail domain vocabulary: brand_* for links, display_domain for labels by @delano in https://github.com/onetimesecret/onetimesecret/pull/3620
• Remove the inert CodeQL advanced-setup workflow and config by @delano in https://github.com/onetimesecret/onetimesecret/pull/3619
• Consolidate brand identity to single authority (#3612) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3622
• Bind incoming secrets to custom domain and update email layout branding by @delano in https://github.com/onetimesecret/onetimesecret/pull/3617
• Fix double-reveal race on burn-after-reading secrets with atomic CAS by @delano in https://github.com/onetimesecret/onetimesecret/pull/3615
• Add support for domain validation UI for multiple strategies by @delano in https://github.com/onetimesecret/onetimesecret/pull/3623
• • CSP in Otto's response layer — emit on web by default by @delano in https://github.com/onetimesecret/onetimesecret/pull/3603
• chore(deps-dev): bump yard from 0.9.42 to 0.9.44 in the bundler group across 1 directory by @dependabot[bot] in https://github.com/onetimesecret/onetimesecret/pull/3549
• Refactor domain add/manage UX based on custom domain count by @delano in https://github.com/onetimesecret/onetimesecret/pull/3627
• Harden error logging to prevent query strings and secrets in logs by @delano in https://github.com/onetimesecret/onetimesecret/pull/3629
• chore: documentation tidying and config string-key fixes by @delano in https://github.com/onetimesecret/onetimesecret/pull/3624
• Add incoming secrets mode to custom domain homepage selector by @delano in https://github.com/onetimesecret/onetimesecret/pull/3628
• Fail closed on unrecognized secrets_mode to prevent form exposure by @delano in https://github.com/onetimesecret/onetimesecret/pull/3636
• docs: add accessibility audit for public surfaces (2026-07-04) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3634
• Make GET endpoints safe: record access telemetry instead of mutating state by @delano in https://github.com/onetimesecret/onetimesecret/pull/3635
• Add post-signup email verification confirmation page by @delano in https://github.com/onetimesecret/onetimesecret/pull/3626
• test(a11y): authenticated-surface coverage + enforcement policy docs by @delano in https://github.com/onetimesecret/onetimesecret/pull/3645
• docs: add install & onboarding problem space assessment by @delano in https://github.com/onetimesecret/onetimesecret/pull/3638
• Add Configuration Generator JSON API (UI lives in the docs site) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3644
• docs: add schema complexity verdict and reduction plan by @delano in https://github.com/onetimesecret/onetimesecret/pull/3652
• fix(nav): close scope-switcher dropdowns after navigation (domain + org) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3654
• fix(a11y): make scope-switcher row a div to avoid nested buttons by @delano in https://github.com/onetimesecret/onetimesecret/pull/3659
• Refactor scope switchers to use shared ScopeSwitcher engine by @delano in https://github.com/onetimesecret/onetimesecret/pull/3658
• test(a11y): scan interactive states (dropdown, error banner, modal) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3657
• docs: domain-validation ADR set, spec re-homing, and reference fixes by @delano in https://github.com/onetimesecret/onetimesecret/pull/3656
• Enable XChaCha20-Poly1305 encryption with libsodium and audit DPA compliance by @delano in https://github.com/onetimesecret/onetimesecret/pull/3616
• docs(domain-validation): promote ADR-015..018 to accepted by @delano in https://github.com/onetimesecret/onetimesecret/pull/3661
• docs: Colonel Admin Rebuild spec set (epic #3653) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3660
• Add billing-payer decoupling design spec by @delano in https://github.com/onetimesecret/onetimesecret/pull/3663
• Reduce redundant HomepageConfig reads in domain validation by @delano in https://github.com/onetimesecret/onetimesecret/pull/3665
• Align V1 receipt endpoint with V2/V3 reveal rules for secrets by @delano in https://github.com/onetimesecret/onetimesecret/pull/3664
• Small refinements to Incoming Secrets settings UI* by @delano in https://github.com/onetimesecret/onetimesecret/pull/3666
• fix(receipt): stop GET from mutating secret state; make creator reveal once-only (#3633) by @delano in https://github.com/onetimesecret/onetimesecret/pull/3668

Full Changelog: https://github.com/onetimesecret/onetimesecret/compare/v0.26.0-rc0...v0.26.0-rc1