Privacy hardening for leave, safer sign-in, and expense workflow polish
This release closes a set of leave-privacy gaps so a leave marked Private stays private everywhere it is surfaced — the dashboard, the calendar, the iCal feed, digest emails, and the mobile app — and tightens who can act on a cancellation request. It also hardens the sign-in forms and brings a batch of expense-workflow improvements on the web.
Privacy & Security
- Private leave stays private, end to end — A private leave type no longer leaks its purpose to people who shouldn't see it. Every free-text field on a leave (the reason, notes, approver comments, and rejection / cancellation reasons) is now hidden from anyone who isn't the leave's owner, an admin/executive, or the owner's department head. Previously a colleague in another department could read a private leave's cancellation reason from the details view.
- Consistent redaction across every surface — The same rule is now applied wherever leaves are shown to others: the dashboard, the per-user calendar, the subscribable iCal calendar feed, and the scheduled digest emails. A department head subscribing to a direct-reports iCal feed no longer receives the real type name or reason of a private leave belonging to someone outside their department.
- Cancellation review limited to the right approvers — Approve / Decline actions on a leave cancellation are now shown only to the people actually authorized to review that request (the owner's department head, or an admin/executive), on both web and mobile.
- Safer authentication forms — The login, registration, and SSO sign-in forms now submit explicitly over POST, and the UI library was updated to a version that guarantees the same, so credentials can never be placed in a URL if a form is submitted before the page finishes loading.
Expenses
- Download all receipts as a single ZIP — Export every receipt on an expense report in one archive instead of saving them one at a time.
- All Claims filter — The expenses list gains an "All Claims" filter so you can see every claim in one place.
- Clearer receipt uploads — Upload prompts now list every supported receipt format, and the claim header carries a hover help note explaining the workflow.
- Verify scanned figures — After a receipt scan, a reminder now prompts you to confirm the extracted amounts before submitting.
- Cleaner per-diem view — The per-diem Actions column is hidden once a report is no longer editable, removing controls that would not do anything.