Release log
What changed in Cruxes
One entry per release, in plain words. Nothing is listed until it is live, and nothing that is still switched off.
Security updates to the web app's framework and its outbound connections
The web app moved to a patched release of its framework and stopped accepting certificates from one certificate authority on the connections it makes, and the Cruxes card in Claude now says when a question was already set aside instead of showing a save error.
- Security and privacyThe web app now runs Next.js 16.4.1, which fixes two critical and one high-severity security issue in the framework.
- Security and privacyWhen the web app connects out to another service, it no longer accepts certificates issued by eMudhra's emSign certificate authorities.
Sign-up is open, and developers have a page of their own
Anyone can now sign in and start using Cruxes with a personal or work address, and the site links to a developer page you can read before signing in.
- Security and privacyTo stop mass sign-ups, one network can create only a few new accounts a day and sign-in attempts from one network are rate limited; the new-account limit never applies to an account that already exists.
Extension uploads and Slack conversations stay out of web search
Files you upload through the extension, Google documents you open with it, and conversations from Slack or the Google Workspace add-on never go to web search, and the web app says why a search was skipped.
- Security and privacyA file you upload through the extension or attach in a chat, or a Google Doc or Drive file you open with the extension, is never sent to web search or another service the privacy page marks optional; files uploaded through the extension are still indexed with Google's embedding model, so a later confidential conversation can draw on them.
- Security and privacyA conversation or email that comes from Slack or the Google Workspace add-on never reaches web search, and the web app says why a search was skipped.
- Security and privacyA sign-in account is joined to an existing user only through that user's own verified email address.
Safer recommendations, decision charts for agents, and fewer repeats
In gate_cruxes, cruxes Cruxes marks as sensitive no longer carry the detector's own recommendation, agents can draw a decision chart for a crux with two or more options, and most repeated cruxes in one run are neither shown nor billed.
- Security and privacyJev is not asked about sessions marked confidential.
Google sign-in needs a verified email
Signing in with Google is refused when Google has not verified the email address.
- Security and privacyGoogle sign-in refuses an email address Google has not verified.
Enter answers a card, and sessions keep their own goal
Enter sends a typed answer, leaving a session mid-answer keeps your draft, and the Terms and Privacy pages take their retention periods and subprocessor list from the code.
- Security and privacyThe Terms and Privacy pages now take their retention periods and subprocessor list from the code.
- Security and privacyWhen Cruxes hands a plan to a coding agent, the plan and the decisions in it are marked as quoted material, and the agent is told not to follow instructions inside it.
Slack cards match the app, and sessions are better protected
Cards in Slack follow the same layout as the web app, and one person can no longer write into another person's sessions.
- Security and privacyNobody can create or write into another person's standing sessions or the reserved session names, crash reports no longer share one bucket, and video events follow session ownership.
- Security and privacyThe privacy page now says that quoted sentences are sent to the ranking service.
Cards name their source, and Cursor can connect
A card says which words it came from and when they were written, and Cursor's web agents can sign in.
- Security and privacyOur usage statistics keep the campaign tags on a link and receive only the page path of where you came from.
Analytics no longer receives page addresses with secrets
Usage statistics see only the page path, never the part of an address after the question mark.
- Security and privacyOur usage statistics receive only the page path, never the part of an address after the question mark, so private links and sign-in codes are no longer sent.
Launch-week fixes
A signed-in home, a quieter extension, and four corrections to the API and the privacy page.
- Security and privacyThe privacy page names the model hosts we use and says which of them reach Claude.
- Security and privacyThe web framework moved to its latest patch release.
Connect the Chrome extension from your account
The extension gets its own sign-in token in one click, and mobile sign-in follows the invite list.
- Security and privacySigning in with Google or Apple in the mobile app follows the same invite list as the web.