July 2026
Security & privacy hardening
- Enforced browser security headers and a Content-Security-Policy across the app.
- Hardened the embeddable widget loader and widget-session CORS for merchant storefronts.
- Added robots.txt, sitemap.xml, a security.txt disclosure contact, and this changelog.