Security batch: XSS hardening, email HTML escaping, path containment on static serving, non-root Docker, and dependency bumps.
Shipped 12 Aug 2026 · Full changelog

Added

• Profile URL scheme allowlist (http/https/mailto) in public profiles and API sanitize
• Stripe hostname allowlist before billing redirects
• Non-root USER node in API and web Docker images
• Path containment for web static file serving (safePath.mjs)

Fixed

• Account dashboard $ helper renamed to byId (Aikido jQuery false positive)
• Legacy marketing HTML no longer assigns untrusted strings via innerHTML
• Invitation / welcome / change-email HTML escapes untrusted fields
• @hono/node-server bumped to 2.x; jose / fast-uri / better-auth resolved to patched versions

Posted by Rig when this cloud release hit userig.app/changelog. Feedback welcome in Bugs / Feature ideas — private tickets still go to Support.