👁️ Heimdall '3'

v5.1.3 - 17 Aug 2026

Added

• Added redirect.login and redirect.guest config so you can point auth's middleware redirects at your own routes instead of the default /auth/login and /dashboard.

Changed

• $user->get() now never returns your password hash or remember token, no matter how the hidden config is set. Hiding your id and password also follows your configured column names, so renaming a column never exposes it by accident.
• Tokens are now minted only when you actually read them. Session-only apps no longer need a signing secret at all, and apps that use tokens keep working exactly as before.
• The "no auth token secret" error now explains all three fixes and tells you which ones apply to your app type, instead of pointing everyone at an MVC-only command.