March 16, 2026

Taskade developer changelog — March 16, 2026: Security Hardening for API Integrators and Credential Holders.

Developer highlights. This section tracks API, MCP, SDK, automation, and Taskade Genesis platform changes for developers. For the full product changelog see taskade.com/changelog; for release newsletters see taskade.com/blog/updates.

What's New:

Security Hardening for API Integrators and Credential Holders

Several security fixes shipped this week that affect integrators, OAuth2 credential holders, and Genesis app operators:

• Credential masking in Genesis app debug prompts — the Genesis app builder (EVE) now sanitizes error context before including it in AI debug prompts, preventing config values and secrets that appear in app-preview errors from being echoed back in AI responses, and adds a system-prompt instruction not to echo credentials.

• Per-account login rate limiting — accounts are now rate-limited on authentication attempts (CASA ASVS 2.2.1). Automated integration scripts that rely on rapid re-authentication should handle 429 responses with exponential backoff.

• Password minimum raised to 12 characters + breach checking — accounts that authenticate via password (as opposed to OAuth SSO) now require a minimum of 12 characters and are checked against known-compromised password databases. This applies to API Personal Access Token (PAT) account holders who use password-based login.

• Custom OAuth intermediary page text — automation piece authors can now supply custom install-page text (title, message, and button labels) to brand the OAuth install-redirect page shown to users during piece authorization. Relevant for custom piece development.

Reference: Automation Integrations | Webhooks