Security hardening for MCP auth, process spawn, and the local Express dashboard.
Shipped 12 Aug 2026 · Full changelog · Download for Mac

Added

• Helmet security headers on the local desktop Express dashboard

Fixed

• Process spawn no longer uses shell: true for package-manager scripts; Procfile/compose/artisan lines run via fixed /bin/sh -c
• MCP Bearer token compare uses crypto.timingSafeEqual

Posted by Rig when this build hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.