Security Fixes, Enterprise SSO & Five New Features

Four security advisories published in 2026, five new features on pwpush.com, and four OSS releases. Let's get to it.

OSS Password Pusher

👮 Security Advisories

Four security advisories have been published to the GitHub Security Advisories page in 2026. If you're self-hosting OSS Password Pusher, please update to at least v2.9.7.

• GHSA-jf2m-hpj9-4qx2 (Moderate) — Unauthenticated users could delete anonymous pushes even when the creator disabled "deletable by viewer." Fixed in v2.9.6.
• GHSA-59w3-h5v2-c4xw (High) — Passphrase brute-force via unthrottled access endpoint with no per-push lockout. Fixed in v2.9.2.
• GHSA-76c2-66pg-fj2f (High) — data: URI accepted as URL push payload, enabling redirect-based XSS. Fixed in v2.8.1.
• GHSA-qfh8-f79c-x86c (Moderate) — Authentication bypass in JSON API file push creation. Fixed in v2.4.2.

Thank you to @theopaid, @de3erve, @geo-chen, and Yuming Zhang and Song Li of Zhejiang University for responsibly disclosing these issues.

All four have been patched and published with full technical details on the advisories page. pwpush.com was patched immediately in each case. If you're running a self-hosted instance, v2.9.7 covers everything.

🐣 Releases: v2.9.4 through v2.9.7

Four releases since the July newsletter. Beyond the security fixes above:

• v2.9.7 — Hardened push ownership checks, fixed SMTP TLS failures when openssl_verify_mode is configured
• v2.9.5 — Ruby 4.0.6, clarified share-message expiration copy, dependency and security updates
• v2.9.4 — Latest language strings, dependency and security updates

As always, dependency and security updates ship with every release cycle. The latest is v2.9.7.

New on pwpush.com

🌐 Custom Domains Now Available on Premium

Premium subscribers can now add a custom domain to their workspace. Your push links and retrieval pages will come from your own domain. Setup is the same as it's always been: add a CNAME record and configure the domain in your account settings.

🏢 Enterprise SSO

IT-configured Single Sign-On is now available on the hosted service for Pro subscribers. You can connect your Google Workspace or Microsoft Entra ID tenant so your team signs in through your identity provider — and you can enforce SSO as the only login method, so password-based login is disabled entirely for your workspace.

This is real enterprise SSO: your IT admin configures the identity provider connection, not individual users picking a social login button. Enforceable SSO-only login means you control who has access through your IdP, and revocation is instant when someone leaves the organization.

🏰 Send from Your Own Email Domain

Pro subscribers can now route all Password Pusher emails — push notifications, request invitations, and recipient verification codes — through your own email domain. Connect your Google Workspace (Gmail API) or Microsoft 365 (Microsoft Graph) OAuth app, and recipients see emails from your domain rather than from pwpush.com.

This is particularly useful for organizations where emails from unfamiliar domains get flagged or filtered. Your clients and colleagues already trust your domain.

🔑 Authenticated Recipients

One of the most requested features since 2024: recipient identity verification.

When you send a secret with Auto-Dispatch, you can now require recipients to verify their email address with a one-time code before viewing the content. The recipient opens the link, enters their email, receives a 6-digit code, and enters it to unlock the secret. If the email doesn't match the authorized list, the same interface is shown but no code is sent — no information leakage about who was supposed to receive it.

The difference from a passphrase: a passphrase proves someone has a code. Email verification proves someone is the intended recipient. Forwarded links don't work unless the forwardee is on the allowlist.

Codes are hashed before storage, single-use, and rate-limited. It stacks with passphrases for defense-in-depth. Works for both pushes and requests. Account and workspace admins can enforce it by policy.

Available now on pwpush.com for Premium and Pro plans. Blog post with full details

🪝 Webhooks (Beta)

Password Pusher Pro now sends real-time event notifications to your own endpoints.

Configure webhook endpoints in your workspace settings (Workspace → Policy → Webhooks), and Password Pusher will POST event notifications when pushes and requests are created, first viewed, or expired — and when a request response is received. Up to 5 endpoints per workspace.

Deliveries follow the Standard Webhooks specification — signed with HMAC, timestamped, and with an idempotency key for safe retry handling. Payloads are metadata-only: push content, passphrases, and request responses are never included in webhook deliveries.

Available on pwpush.com for Pro plans. Webhooks documentation

📰 New on the Blog

Five new posts since the July newsletter:

• Webhooks: Real-Time Event Notifications for Your Workspace — How webhooks work, event types, security details, and setup walkthrough.
• Authenticated Recipients: Verify Who Views Your Secrets — Email OTP verification for pushes and requests.
• OSS Password Pusher Can Now Email Pushes Directly to Recipients — Auto-dispatch moves to the open source edition via the Feature Pipeline.
• How to Securely Collect Passwords from Clients — Using request links to collect credentials without email.
• The Best Way to Securely Share Passwords — Why most people get it wrong and how one-time links solve it.

📺 Video Coverage

Password Pusher has been getting some attention on YouTube recently. If you prefer video, here are three worth watching:

• Password Pusher: Secret Links That Die After 1 View — A quick walkthrough of how self-destructing secret links work.
• Install Password Pusher V2 on CasaOS or ZimaOS — An updated guide to self-hosting OSS Password Pusher v2 with Docker Compose, from the Big Bear community.
• Pwpush: Send a Password Securely — A clear overview of using pwpush.com to share credentials without leaving them in chat or email.

Thank you to everyone creating content around Password Pusher — it's always great to see the community sharing knowledge.

⛅ One-Click Cloud Deploys

If you want to self-host OSS Password Pusher but don't want to manage Docker Compose yourself, several cloud platforms now offer one-click deployments:

• Hostinger — VPS Docker hosting with built-in firewall and DDoS protection
• PikaPods — Deploy in seconds, pay by the hour
• Elestio — Fully managed hosting with a free $20 trial credit
• Easypanel — Deploy on your own server with automatic HTTPS provisioning
• Cloudzy — VPS marketplace with one-click install from ~$2.48/month
• OctaByte — Fully managed with automated backups, SSL, and 24/7 support

All of these deploy the open source edition. If you need Pro features (team management, custom domains, white-label branding, SSO), see the Self-Hosted Pro documentation.

💌 Thank You

Every Pro subscription helps fund development across both commercial editions and open source. Thank you to everyone running Password Pusher in production, supporting through subscriptions, filing issues, and sharing feedback — and especially to the security researchers who continue to help us harden the project.

Thanks for making it to the end!

This newsletter is the extent of our marketing thus far. We've never run an ad once and don't have any plans currently to do so. Organic growth has brought us this far and we feel honored to be able to serve the community. Thanks to all.

Peter Giacomo Lombardo & the Apnotic Team