Changelog - Dev - 08.18.2026

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog.

---

[Unreleased] - 2026-08-18

Security

• Enforce invite requirement at account creation: Account creation was invite-gated only at the client level, allowing direct calls to the creation endpoint to bypass the gate entirely. This change moves invite validation to the server and makes account creation server-only, ensuring the invite requirement is enforced at the API boundary. (#902) security bug