> For the complete documentation index, see [llms.txt](https://docs.taskade.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.taskade.com/changelog/changelog-2026/march-2026/march-28-2026.md).

# March 28, 2026

Taskade developer changelog — March 28, 2026: @taskade/embed Migrated into Monorepo with Security Hardening, HSTS Header Configured Explicitly for API…

{% hint style="info" %}
**Developer highlights.** This section tracks API, MCP, SDK, automation, and Taskade Genesis platform changes for developers. For the full product changelog see [taskade.com/changelog](https://www.taskade.com/changelog); for release newsletters see [taskade.com/blog/updates](https://www.taskade.com/blog/updates).
{% endhint %}

## What's New:

### @taskade/embed Migrated into Monorepo with Security Hardening

The `@taskade/embed` package — the floating-popup AI agent chat widget for embedding Taskade agents on external websites — is now versioned and released alongside the rest of the Taskade platform. Version 1.1.1 is published. Key security improvements shipped alongside the migration:

* **`sandbox` attribute added to the embed iframe** — the agent chat iframe now carries `sandbox="allow-scripts allow-same-origin allow-forms allow-popups"`, restricting what the embedded frame can do on the host page. Host page developers who embed agents via the widget should review these sandbox permissions if they rely on cross-frame interaction.
* **`title` attribute set on the embed iframe** — improves accessibility for screen readers on host pages.
* Shadow DOM style isolation and React 18 compatibility improvements were also included.

The embed package is published to the GitHub npm registry with automated build and release workflows.

Reference: [API Guide](/developers/comprehensive-api-guide.md)

***

### HSTS Header Configured Explicitly for API and Webhook Endpoints

`Strict-Transport-Security` is now set explicitly in backend responses (CASA 14.4.5), ensuring HTTPS enforcement for all API and webhook endpoints. No client-side changes are required, but integrators relying on HTTP-only endpoints should ensure all requests use HTTPS.

Reference: [Webhooks](/developers/webhooks.md) | [Automation Integrations](/automations/automation/integrations.md)

***

### Automation Flows Auto-Enable on .tsk and GitHub Import

When a `.tsk` app kit or a GitHub-hosted bundle is imported into a workspace, flows that do not require external OAuth credentials (Taskade internal triggers, webhook triggers, and manual triggers) are automatically enabled after import; flows requiring OAuth credential connections are skipped and must be enabled manually. Previously, all flows imported via bundle required manual enablement. This is relevant for developers distributing Taskade apps via the bundle format who want compatible flows to be active immediately on install.

Reference: [Bundles & App Kits](/developers/bundles.md) | [Automation Actions](/automations/automation/actions.md)

***

### Agent Message Metadata Now Includes Finish Reason

The agent chat message metadata schema now surfaces a `finish` field containing the AI SDK `FinishReason` value returned by the underlying LLM. The field is optional and present only when the model returns a finish reason. Values follow the AI SDK `FinishReason` enum (e.g. `stop`, `length`, `tool-calls`, `content-filter`). Developers building on top of the agent chat protocol or inspecting message metadata can use this to detect truncated responses or tool-call termination.

Reference: [API Guide](/developers/comprehensive-api-guide.md) (shipped March 31)