Invites now control onboarding—new teammates must be added by an organisation member instead of self-signing up. Password resets now log you out of other browsers/devices to prevent lingering sessions. Sign-in sessions and reset flows were updated after a security review; no action needed from your team.