# 24 September: security hardening for previews, sign-in and WebDAV 2026-09-24 · Security > A set of security fixes went live on 24 September. The old standalone builder console was removed. Added on 23 October 2026 from the repository history. *Where a workspace and its preview are separated from the rest. Diagram from the docs.* Text version Every workspace runs in its own container. A shared preview is shown in a sandbox with its own origin and cannot reach the account or follow links out of the container. ## Security - Shared preview links (/s/) run the page in a sandbox with an opaque origin. A preview no longer follows symlinks out of your container. - Passkey sign-in and "forgot password" no longer reveal whether an account exists for an address. The passkey relying-party ID is no longer taken from a forwarded host header. - WebDAV (/dav) limits failed password attempts per address and hashes passwords off the main thread. - Sessions started from one device are linked, so revoking a session also revokes the related ones. - WebHook AI targets go through the research blocklist, and redirects are not followed. - A security.txt (RFC 9116) and an MTA-STS policy for mail are published. ## Fixed - The sitemap no longer lists pages that return 404. ## Removed - The old standalone builder console (admin.zerolog.ch and /builder/?embed=1). /builder now forwards to /next/builder/. The builder itself is unchanged.