So, i had OpenCode do a look around the codebase for vulnerabilities and bugs that i should fix before release. However, the edits were done by me. This devlog is basically that:

• fixed an IDOR vulnerability that allowed any authenticated user to uncancel any class by just having its ID. .
• when trying to log in with an account that does not exist, the api now raises a password incorrect error instead of user_not_found . .
• added rate limiting to /v1/auth/pwd (5 per minute) , /v1/auth/signup (20 per hour) and /v1/auth/verify (2 per minute).
• Improve email validation on account creation.
• Added password requirements on signup..
• Enforce email verified in endpoints.
• Fixed a vuln that allowed the ?next=//example.com param to redirect to any website after login.
• Added a FAQ in the calendar settings page ‘Why is my calendar not updating?’.
• Don’t allow class deletion if used by evaluation.
• Add loader and icon to the class deletion modal..
• Don’t allow subject deletion if used by class..
• Rename canceled to cancelled in many parts of the code..
• Ensure character count limit (8-50 in most places).
• Relax rate limits.
• [OpenCode] Created a migration worker.
• Migration to remove depreacted onboarding_status field..
• Made many things TZ aware and added an user timezone field in the IANA format..
• [OpenCode] Tried, and failed to add mobile support..
• Standernize responses in the valid_json decorator.

Many of the changes are non-visual, so i put the devlog image as the new FAQ.