Security Fixes, Auto-Dispatch Moves to OSS & More

It's been about seven weeks since the May newsletter. Ten releases, two security fixes, and a major Feature Pipeline release. A lot to cover, so let's get to it.

OSS Security Updates

Two security vulnerabilities were reported and patched since May. If you're self-hosting, please update to at least v2.9.3.

CVE-2026-59802 (High, CVSS 8.2) — A data: URI could be submitted as a URL push payload, causing a redirect-based XSS under the trusted domain. Fixed in v2.8.1 by restricting URL push schemes to http and https only.

GHSA-59w3-h5v2-c4xw — The passphrase verification endpoint lacked per-push throttling, making short passphrases vulnerable to brute-force. Fixed in v2.9.2 with rate limiting and lockout on the access endpoint.

Thank you to @geo-chen and @de3erve-hunter for responsibly disclosing these issues.

We also hardened our GitHub Actions CI/CD workflows in v2.7.4 — thank you to @guervild for that report.

Notify by Email (Auto-Dispatch) — Now in OSS

This is a Feature Pipeline release: auto-dispatch has been available on pwpush.com as part of the Pro edition, and is now included in OSS Password Pusher for all self-hosted deployments starting with v2.9.0.

When you create a push, you can now enter one or more recipient email addresses directly in the form. Password Pusher will email the secret link to each recipient on your behalf — with full audit logging and support for 30+ languages.

• Up to 5 recipients per push, across all push types (text, file, URL, QR)
• Language selection for the email and the secret link page
• Works from the preview page too — forgot to add recipients when creating? Send from the push preview page after creation
• Full API v2 support — notify_by_email object on push creation, plus a separate endpoint for existing pushes
• Configurable daily limit per user (PWP__NOTIFY_BY_EMAIL__DAILY_LIMIT, default 500/day) and rate limiting (5 requests/minute)
• Can be fully disabled with PWP__NOTIFY_BY_EMAIL__ENABLED=false

Auto-dispatch activates automatically when SMTP is configured on your instance. If your instance can send email, the auto-dispatch fields appear in the push creation form for signed-in users.

Read the full blog post: OSS Password Pusher Can Now Email Pushes Directly to Recipients

Documentation: Notify by Email (Auto-Dispatch)

pwpush.com: New Landing Page

After fifteen years of the push creation form as the homepage, pwpush.com now has a proper landing page for new visitors. The landing page explains what Password Pusher is, how it works, and links to the different editions.

If you're a regular user who prefers to go straight to push creation, you can bookmark pwpush.com/p/new — it takes you directly to the push form, same as the old homepage. Anonymous, no-account usage works exactly the same as it always has. You can also go directly to your preferred data region: eu.pwpush.com/p/new or us.pwpush.com/p/new.

Open Source: v2.7.0 through v2.9.3

Ten releases since May. Beyond the security fixes and auto-dispatch covered above, here are the other highlights:

Block Robot Indexing — v2.8.0 adds a PWP__NOINDEX environment variable. Set it to true and your self-hosted instance will add noindex meta tags and a restrictive robots.txt to keep search engines from indexing your deployment.

Hardened Crawler Protections — v2.8.2 adds additional protections against crawlers and bots for self-hosted deployments.

GDPR / Asset-Loading Hardening — v2.7.0 ensures no remote assets are loaded from external sources, closing a gap where some had crept back in. Important for privacy-conscious and GDPR-sensitive deployments.

Permissions-Policy Security Headers — Fresh in v2.9.3: the application now sends restrictive Permissions-Policy headers to reduce the potential attack surface, mitigate XSS and third-party risks, improve privacy, and provide better control over iframes.

Ruby 4.0.5 & Alpine Base — v2.7.1 updates the Docker image to the latest Ruby and Alpine for better performance and security.

As always, dependency and security updates ship in every release cycle.

If you just want to try OSS v2 immediately: oss.pwpush.com

CLI

v0.16.3 shipped with dependency and security updates. No new features in this cycle — the major overhaul landed in May.

New on the Blog

Three new posts since last time:

• Password Protected File Sharing — Without the Overhead — How Password Pusher handles file sharing compared to portals and encrypted email.
• What Is a One-Time Password Link (And How to Create One) — A practical walkthrough for anyone new to self-destructing secret links.
• How to Send a Password Protected Email (And Why You Probably Shouldn't) — Why the traditional approach fails and what to do instead.

What's Next

Enterprise plan for pwpush.com — a new Enterprise tier for the hosted service is in the works.

A note for newsletter subscribers — we'll be adjusting pricing on pwpush.com hosted plans in the coming weeks. Nothing changes for existing subscribers on their current plans. If you've been considering a subscription, the current pricing is still available now — and annual plans lock in that rate for the full term. I wanted to share this here first.

Thank You

Password Pusher is now more than fifteen years old, has shared over 100 million secrets, and passed 50 million Docker container downloads. The security-critical codebase remains fully open source and auditable on GitHub.

Every Pro subscription helps us keep shipping updates to both commercial editions and open source. Thank you to everyone running Password Pusher in production, supporting through subscriptions, filing issues, and sharing feedback.

Thanks for making it to the end!

This newsletter is the extent of our marketing thus far. We've never run an ad once and don't have any plans currently to do so. Organic growth has brought us this far and we feel honored to be able to serve the community. Thanks to all.

Peter Giacomo Lombardo & the Apnotic Team

• Hosted Pro: pwpush.com
• Self-Hosted Pro: Self-Hosted Pricing
• Open Source: github.com/pglombardo/PasswordPusher
• Docker Images: pglombardo/pwpush
• Blog: docs.pwpush.com/blog