[3.2.0] - Stay in the loop

You can now see everything happening on your account: notifications on the site, a list of your signed-in devices, sign-in alerts that are actually accurate, and an audit log admins can read. Every email has a new design, the dashboard has been reworked from top to bottom, and this release fixes several security issues. We recommend upgrading.

Highlights

• Notifications on the site. A bell in the top bar and a full Notifications page. Choose per category whether each one also goes to email or Discord.
• Your devices. Profile → Security lists every browser signed in to your account. Rename one or sign it out.
• Better sign-in alerts. Sent only for devices we haven't seen before, showing the device, location and time in your own time zone.
• Data exports by email. Profile → Data → Email me my data builds a ZIP in the background and emails you a 7-day link. Big accounts no longer time out, and files are no longer skipped.
• Short links on your own domains. Pick any verified custom domain when you shorten a link, or let it default to your primary domain.
• Rebuilt Files and Upload pages. Files has an always-visible search, a cleaner filter toolbar with removable filter chips, and tabs for your files, shared files and squads. Upload shows your files and their progress next to the options, picks expiry inline, and keeps finished uploads listed with copy buttons.
• Every email redesigned. All 33 emails share one clean layout with a plain-text version. Self-hosted instances show their own name and logo throughout.
• A new look for the dashboard, admin and profile. A section bar replaces the sidebar so pages use the full width, file thumbnails show the image itself, and 2FA setup, editing and confirmations happen on the page instead of in pop-ups.
• Admin tools. An audit log that reads like an activity feed, a much tidier settings area, and a system health panel that shows email, Discord, license and disk status, with a Copy debug info button for bug reports.

Security

These are fixed in 3.2.0:

• Signing out everywhere didn't end other sessions. "Sign out everywhere", password resets and admin sign-outs marked sessions as outdated, but the sessions kept working. They now end immediately.
• User search exposed email addresses. GET /api/users/search could be called without signing in and returned matching email addresses. It now requires sign-in, only matches a full address, and never returns one.
• Server-side request forgery through Discord webhooks. The notification webhook URL could be any address, including internal ones, and the server would send requests to it. Only Discord webhook URLs are accepted now, and messages can no longer ping @everyone or roles.
• Admin announcement emails didn't escape HTML. HTML in an announcement's body was sent as-is, and javascript: links weren't removed. Both are handled now.
• Editing a file returned its password hash. Fixed. Passwords set on files by admins are also stored hashed now.
• Hardening: deleting your account now requires your password, so a leaked API key or upload token can't do it.

Upgrading (self-hosted)

1. Run bun run db:deploy (or let the Docker image run it). There are four new migrations: devices, notifications, short-link domains and data exports.
2. Background jobs now run inside the app by default, in production too. If emails, notifications or Discord alerts stopped working on your server, this is the fix. If you run a separate bun run worker, set EMBERLY_RUN_EVENT_WORKER=false on the app (leaving it on is harmless).
3. SMTP set only in environment variables now works. Emberly used to send through Resend unless SMTP was also chosen in Admin → Settings → Integrations. It now uses whichever provider is configured.
4. After upgrading, anyone who should already have been signed out will be signed out. That's the session fix taking effect.

API changes: POST /api/profile/export replaces the old streaming GET /api/profile/export and /progress endpoints. POST /api/urls accepts an optional domain, and responses include each link's full url. New endpoints: /api/notifications, /api/profile/devices and the admin-only /api/admin/system.

Discord bot: /shorten now replies with the link on your custom domain when one is used.

Full details are in the changelog.