Other Improvements
Revised how long you stay logged in
You now need to log in again when 30 days have passed since your last login, or when there has been no activity for 14 days. Login sessions that were previously kept for a long time will expire gradually after this release. If that happens, please log in again. When you change or reset your password, you are now logged out on other devices, and connections to CheckBack and MCP integrations (external AI tools) are disconnected. Please log in to CheckBack again and reconnect your MCP integrations.
Revised password rules
Password rules have been revised in line with the U.S. authentication guidelines (NIST SP 800-63B).
Password rules have been unified to "at least 8 characters", and passwords no longer need to include uppercase letters, lowercase letters, numbers, and symbols (sign-up, change, and reset). This is because a password that is hard to guess is considered safer than one that mixes character types in a prescribed way.
When setting a new password, you can no longer use a password identical to one leaked in past data breaches at other services. The check uses a public database of leaked passwords.
The same check is also performed on your existing password when you log in. Only if it matches, a screen recommending that you change your password is shown.
This screen does not indicate that any information was leaked from CheckBack. Nor does it indicate that your email address and password combination was leaked. It indicates that the same string as your password was included in data from a breach that occurred at another service.
Your password itself is never sent externally during the check (only the first part of a value calculated from your password is used).
Changing your password is optional. If you select "Later", you can continue using CheckBack as is. However, if you keep the same password, the screen will be shown again the next time you log in. Because your password could be guessed or misused by a third party, we recommend changing it to one you do not use for other services.
For accounts created by our staff, you will now set your own password the first time you log in.
Limited the number of login and verification code attempts
After several consecutive failed login attempts, you will be unable to log in for a while. If you enter the verification code sent by email incorrectly several times in a row, that code becomes invalid and you will need to request a new one. Limits have also been added to resending verification codes and sending password reset emails.
Changed the messages for password reset and sign-up
The password reset screen now shows the same message whether or not the email address you entered is registered. A reset email is sent only if the address is registered. If you enter an already registered email address when signing up, you will receive an email letting you know that "This email address is already registered" instead of a verification code.
Added a confirmation screen for disabling two-factor authentication
When you disable two-factor authentication from your account settings, a confirmation screen is now shown, and two-factor authentication is disabled only after you press the button.
Security improvements
We have made changes to strengthen the security of login, account registration, email address changes, email, Slack notifications, Talk, and member management.
Bug Fixes
Fixed users invited as Members joining the workspace as Admins
Fixed an issue where, when inviting someone not yet registered with CheckBack to a workspace by email address, they joined as an "Admin" even though they were invited as a "Member".
Fixed line breaks in invitation messages not appearing in emails
Fixed an issue where line breaks in the message added to an invitation email were turned into spaces in the email. Line breaks in the message of IP restriction removal request emails are now also preserved.
Fixed links and symbols not displaying correctly in Slack notifications
Fixed an issue where links in the body of comment and Talk Slack notifications were sometimes not displayed correctly. Also fixed an issue where symbols such as " in the body were displayed as strings like """.
Fixed being unable to connect to the MCP integration from ChatGPT
Fixed an issue where trying to connect to CheckBack's MCP integration from ChatGPT resulted in an error on the authentication screen and the connection could not be completed.