18 entries · Security · September 2026 – October 2026
Newsroom
Product changes, pricing and privacy. What changes for you, newest first.
Gray to violet: background to important changes. Editorial user impact, not security severity.
- Passkey confirmation for vault changes, and use only for databases Changing where a secret may go, or showing it, needs your passkey, checked by the key service itself. The key service also reports every change to your protection to you directly. Vault changes and showing a secret now need your passkey, and databases work with use only.
- Credentials in tool output are blacked out before storage and before the model A command like env could print a proxy password into the chat. Output of tools now passes a blackout step before it is stored or sent to a model provider. Passwords and keys printed by commands like env are masked before storage and before they reach a model provider.
- Vault entries now have three states Visible, use only or locked: the AI reads a value only where you release it, or works with a placeholder and never sees the real one. Each vault entry is visible, use only or locked, so the AI can work with a placeholder and never see the real value.
- 22 October: security audit fixes and a zero-downtime deploy path An audit of our own code led to fixes for access, billing, uploads and agents. Deploys can now switch between two app slots behind a proxy; the first real switch in production ran on 23 October.
- Memory is now encrypted per account Memory entries, writing-style samples, agent memory and the agent journal are stored encrypted with a separate key for each account. This is not end-to-end encryption.
- 19 October: Docker API filter, tighter container egress, Retry-After on rate limits The Docker API on the host sits behind a filter, outgoing traffic from the default Docker bridge is restricted, and rate-limited pairing endpoints say when to retry.
- 13 October: admin second factor, pinned worker keys, restore fixes Several hardening steps and two restore fixes went live in the evening.
- Preview links now expire, and backups are encrypted offsite Container preview links last 7 days by default and can be revoked. Backups are encrypted before they leave the server and copied to a second machine. Preview links created before this update stop working on 20 October 2026 at 15:44 UTC, so create a new link before then if someone still needs access.
- Outbound traffic now has limits, not only an allow-list A handful of service ports are closed for every workspace, and traffic that looks like scanning or password guessing slows down and then stops. Adds outbound limits and closes certain ports; verified testing remains possible within its scope.
- The layer that runs your workspace is now fenced in too The part of the host that executes your workspace can no longer read ZeroLog's own keys, database or configuration. Internal sandbox runtime hardening that prevents the execution layer from accessing host secrets without altering workspace behavior.
- Workspaces no longer share processor cores with other machines The machines that run ZeroLog workspaces now keep their processor cores and memory pages to themselves, which closes two known ways of observing a neighbour through shared hardware. Backend hardware isolation preventing shared CPU hyperthreads and memory deduplication between workspaces.
- Stronger workspace isolation: a VM option and sealed previews Workspaces get an extra system call filter, a new VM isolation class for untrusted code, and previews that can no longer reach your ZeroLog account. Introduces dedicated VM isolation classes, tighter system call filters, and origin-isolated website previews.
- Malware checks across ZeroLog workspaces Local malware checks cover regular and anonymous workspaces. Existing Windows VMs still need protection verified inside each guest. Expands local malware checks; protection inside Windows VMs still needs separate verification.
- Security updates for request handling and admin mail settings We closed a known weakness in how zerolog.ch reads incoming requests, narrowed who can open the admin alert mail settings and tightened the waitlist pages. You do not need to do anything. Routine server library patch addressing request parsing and restricting admin alert mailbox credential access.
- Security signals from sandboxes, filtered before storage ZeroLog now records security signals from its sandbox protections. Detection and alerts are on; automatic countermeasures stay off until they have been validated.
- 24 September: security hardening for previews, sign-in and WebDAV A set of security fixes went live on 24 September. The old standalone builder console was removed.
- ZeroCode for Android 1.17.1: tools ask first and fail honestly The app now asks before a tool changes something on your phone, keeps the AI out of its own settings, and no longer reports container commands that never ran. Requires user approval for state-changing phone tools and shields app storage from file tools.
- What changed on 9 September The builder checks published sites, terminal setup is documented, and account and research options have changed. Summarises updates to site verification, account data export/deletion, and German legal research.