# 22 October: security audit fixes and a zero-downtime deploy path 2026-10-22 · Security > An audit of our own code led to fixes for access, billing, uploads and agents. Deploys can now switch between two app slots behind a proxy; the first real switch in production ran on 23 October. Everything here is in the repository history of 22 October 2026. *How a deploy switches ZeroLog to new code. Diagram from the docs.* Text version Traffic goes through a proxy to one active app slot, blue or green. A deploy starts the idle slot, checks it and switches. ## Security audit - Access: ending a member's access ends the chat's link to the shared workspace. Superadmin accounts can only be changed, locked or deleted by a superadmin. An old invitation no longer undoes a role downgrade. WebDAV writes need the current write role. Feature switches need the settings permission. - Money: credit changes run one at a time per account. Refunds need the billing permission and a positive amount, and the target account is checked before the provider order. Paid add-on quotas no longer come from a user setting. - Agents and keys: key rules and approvals apply to the key actually used. Numeric placeholders in the key proxy bind to the signed-in context. Research and webhook AI calls follow egress rules. The internal agent_run task left the public task list, and the domain-watch run belongs to the job owner only. - Uploads and hosts: one writer per upload, and finishing a busy upload answers 409 instead of 500. The disk guard also freezes sandbox boxes. Host preview goes only to the one authorized target. - Apps: the Android bridge lost its legacy JavaScript interface, QR pairing accepts only your own server, and the sign-out hook also catches /logout/ variants. Missing secret fields were added to the secret list. ## Deploys A deploy starts the idle one of two app slots, checks it, then points the front-door proxy at it. The worker restarts with a drain, and rollback exists. Caveat: the proxy switch first ran in production on 23 October, so we claim no measured zero-downtime deploy for this day. Also: the language sitemap, mobile canonical route and public plan cache were corrected.