> For the complete documentation index, see [llms.txt](https://docs.taskade.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.taskade.com/changelog/changelog-2026/march-2026/march-16-2026.md).

# March 16, 2026

Taskade developer changelog — March 16, 2026: Security Hardening for API Integrators and Credential Holders.

{% hint style="info" %}
**Developer highlights.** This section tracks API, MCP, SDK, automation, and Taskade Genesis platform changes for developers. For the full product changelog see [taskade.com/changelog](https://www.taskade.com/changelog); for release newsletters see [taskade.com/blog/updates](https://www.taskade.com/blog/updates).
{% endhint %}

## What's New:

### Security Hardening for API Integrators and Credential Holders

Several security fixes shipped this week that affect integrators, OAuth2 credential holders, and Genesis app operators:

* **Credential masking in Genesis app debug prompts** — the Genesis app builder (EVE) now sanitizes error context before including it in AI debug prompts, preventing config values and secrets that appear in app-preview errors from being echoed back in AI responses, and adds a system-prompt instruction not to echo credentials.
* **Per-account login rate limiting** — accounts are now rate-limited on authentication attempts (CASA ASVS 2.2.1). Automated integration scripts that rely on rapid re-authentication should handle `429` responses with exponential backoff.
* **Password minimum raised to 12 characters + breach checking** — accounts that authenticate via password (as opposed to OAuth SSO) now require a minimum of 12 characters and are checked against known-compromised password databases. This applies to API Personal Access Token (PAT) account holders who use password-based login.
* **Custom OAuth intermediary page text** — automation piece authors can now supply custom install-page text (title, message, and button labels) to brand the OAuth install-redirect page shown to users during piece authorization. Relevant for custom piece development.

Reference: [Automation Integrations](/automations/automation/integrations.md) | [Webhooks](/developers/webhooks.md)