1.28.1 — Mobile verification recovery and inbound email fixes

2026-09-15 Updated 2026-09-15

Editorial identity incomplete

2026-09-15

Improves hosted Bouncer verification on mobile, adds a support review path, and makes SES receiving setup report actual readiness.

Bouncer support requests with reference codes and a protected operator review queue. Reviewing a request does not grant access.

Recognize stationary taps, pen input, and keyboard activation without requiring mouse movement.
Keep hosted verification valid across network changes within the same browser session while preserving current restrictions.
Bound verification retries, explain cookie and network failures, and refresh expired form tokens before credential submission.
Deliver SES inbound notifications with the S3 bucket and object key needed for ingestion.
Verify active receipt rules and confirmed SNS subscriptions; report AWS failures instead of false success.
Publish receiving MX records correctly through Route53 and GoDaddy.
Support AWS role credentials and bucket SSE-KMS permissions while preserving unrelated policy statements.

Protect recovery contact details and bound diagnostic writes with atomic limits compatible with Redis Cluster.

No database migrations. Deploy Bouncer workers, templates, and scripts together; old workers cannot validate new session passes. Existing passes remain supported.
Forward both verification cookies across protected subdomains. Keep recovery routes reachable, configure BOUNCER_RECOVERY_SUPPORT_URL, and assign an operator to review requests.
SES setup now reports pending subscriptions, conflicting active rule sets, and unsupported receipt-rule encryption or IAM-role configurations for correction.
Validate physical iPhone, Android, and app WebView behavior before production rollout; verify SES receiving with a live staging delivery.