- Use the limits of the API token in more permission checks.
- Show a clearer message when a token limit blocks a change.
- Describe API tokens with limits in SECURITY.md.
- Show a clear message when team-wide write access is needed to use
team credentials.
- Reset the S3 selection on the backup page when a change is not allowed.
- Do not save database backups to S3 when the API request does not
send save_s3, as the API documentation says.
- Check read access on the project or environment for shared variables
pages, the canvas, and the sidebar, not only navigation access
- Require team-wide read for the server shared variables canvas API
- Open the environment variable editor read-only when the value is hidden
- Show the integration tokens button only to users who can open it
- Show disabled confirmation buttons as disabled, not as danger buttons
Andras BacsaiandClaude Opus 5.5