Blog · 25 October 2026 · Nibor

October 2026 on the platform: security wave, token metering, your own web address

October was a hardening month. Most of what shipped is invisible when it works, which is the point, so here is the list.

Security wave

• Stored XSS closed in every runtime component. All 24 data and form components escape what they render; a CI test refuses a new component that writes markup without the escape helpers.
• CORS on the app API answers with the platform origin, never a wildcard.
• Quota and MFA gates fail closed. If the limits lookup is unavailable the request is refused with a clear 503 instead of waved through.
• Sign-in is rate-limited per address and per account, and the auth service has its own limits.
• Account erasure reaches every app. Deleting a platform account now anonymises the person's profile row in each app they signed into, and a real recovery token is proven single-use in the test suite.
• Internal endpoints are internal. The platform's own cache and certificate endpoints answer only in-cluster calls.

Every change was verified on the production node after rollout, and the documentation that describes production is now checked against the server and partly generated from the repository so it cannot drift.

What you see

• Token usage in Studio. Each build turn shows its model calls and tokens under the build card, and the chat header shows this app's tokens for the month next to your organisation's month-to-date against its cap. Organisations that bring their own model key see their usage without a cap.
• Your organisation in the web address. New apps in an organisation are served at <org>-<app>.nibor.io. Existing apps keep their address; an owner can rename it in App Hub and the old address redirects.
• Custom domains spell out the www record. The DNS instructions for a root domain show both records and the verify step reports each one.
• A logo from the first minute. An organisation can carry its logo when it is created, and it appears in the Owner dashboard and in invitation mails.
• App statistics in the Workspace. The Activity tab shows page views, function calls and error rate, AI tokens, generations and record counts per app, with the change feed below.

Under the hood

• The compiler indexes every foreign-key column and maps the money field type to a proper decimal.
• Webhook deliveries are visible per integration, including the reason a signature was refused.

Next

An external penetration test is being commissioned against a published scope, and a public trust page will carry its summary together with the facts about hosting, backups and data handling that we already publish in the repository.