Admin logout now ends the session under the correct cookie path
Admin logout was leaving the session intact due to a cookie path mismatch. Resolved.
— continued
Admin logout was leaving the session intact due to a cookie path mismatch. Resolved.
Permissions-Policy, stricter CSP, and the standard security header set are now enforced consistently at both Apache and Nginx. Eliminates a class of header drift between deployment topologies.
Technical focus: CSP • Permissions-Policy • Apache + Nginx
Cleaned up double borders, fixed shift-time display on the dashboard, and excluded admin-assigned shifts from the approval count.
Mobile tab bar redesigned, User ID is now mandatory on workspace clock-in/out, and form layout improved across screen sizes.
The scanner now shows worker and shift information on every result (success or error), exposes a Scan-next action, and voids QR codes after the shift completes.
QR shift emails now use a card layout with inline QR image and the worker's ID prominently shown — sent in each recipient's preferred language.
QR codes now use compact short URLs (/q/{token}) instead of fully-qualified links. Faster scans on cheap cameras; cleaner emails.
11 changes · 6 added · 3 updated · 1 core · 1 security
Security 2 · Scheduling 2 · Core 1 · Clockwork 1 · Workforce 1 · Payroll 1 · +5 more
Full rewrite of the schedule module covering shift management, filtering, and the assignment flow.
Settings now live on dedicated pages — general, clockwork, notifications, workforce — instead of one long form.
Failed logins are now logged and progressively rate-limited per identifier and per IP — a credible mitigation for credential stuffing.
Technical focus: Per-identifier and per-IP throttling
Starter, Pro, and Enterprise plans with explicit per-plan feature gating and account-subscription management.
Workers can reset their own password via a one-time tokenised email link — removes the manager round-trip for the most common credential issue.
Full Swedish and Danish translations are in place across all modules, including competence type labels.
Track worker certifications, licences, and qualifications with explicit expiry tracking and a verification workflow.
Each form keeps independent field configuration and worker-type defaults — letting one signup link cover heterogeneous crew categories without separate landing pages.
Scheduled shifts can generate and email QR codes. Workers scan to clock in or out — no PIN entry required.
A complete platform rebuild — multi-tenant identity model, unified clockwork engine, mobile-first workspace. Feature parity with v2 plus the architectural runway for the operational tooling rolling out across this release.
4 changes · 4 added
Scheduling 1 · Workforce 1 · Inventory 1 · Messaging 1 · Groups 1 · Locations 1
Send messages to individual users, groups, or subgroups from the workspace.
Create public links that allow crew to register and select available shifts.
Track equipment and manage checkout and return of items to crew members.
Manage venues, areas, and physical locations within an account.
GDPR-compliant cookie banner with category-based consent for essential, analytics, and marketing cookies.
Public terms of service, privacy policy, and cookie policy pages with support for four languages.