| Authentication | Stored credentials were protected with hardcoded encryption keys, and the credential database was protected by a legacy password. | The hardcoded keys and the legacy password have been removed, strengthening protection for stored credentials. |
| Downloads | Certificate validation was disabled for connections to the download server, and the validation callback accepted any certificate. | Certificate validation is enforced, and the callback now fails closed instead of accepting any certificate. |
| Downloads | SSL 3.0 and TLS 1.0/1.1 were explicitly enabled for outbound connections. | Legacy protocols are no longer enabled. The Updater now uses the modern TLS version negotiated by the operating system. |
| General | Bundled third-party components included versions with published vulnerabilities. | Third-party components, including log4net and the web console's npm packages, have been updated. |
| Logging | Passwords and anti-CSRF tokens were written to application log files, and a debug-level log file was written unconditionally to the working directory. | Sensitive values are no longer written to log files, and the unconditional debug log file has been removed. |
| Packages | Package extraction did not validate entry paths, so an archive entry could be written outside the target folder. | Update packages, web policy and plugin packages, and offline package imports now reject any entry that resolves outside the target folder. |
| Web Console | Signing out could act on the wrong session, issued tokens carried administrative rights unconditionally, and token renewal accepted a client-supplied user identity. | Session and token handling have been hardened on all three paths. |
| Web Console | The support package download endpoint and a set of legacy HTTP handlers were reachable without authentication, and the support package could expose the credential database and log files. | These endpoints have been removed or now require authentication. |
| Web Console | The web console did not send the X-Frame-Options header. | The web console now sends the X-Frame-Options header, adding clickjacking protection. |
