Unleash 8.3

Unleash 8.3 is out, and the headline is security: every API token you create from now on is hashed before it ever reaches the database. There’s also a simpler way to add a strategy, three new constraint operators, and a few housekeeping improvements. Let’s get into it.

What’s new in Unleash 8.3

Secure token storage

Unleash now stores API tokens securely by default. Every backend, frontend, personal access, and service account token you create in 8.3 or later is a secure token: Unleash keeps a selector and a hash instead of the complete token, so nothing in the database or its backups can be turned back into a working token. You can spot a secure token by the `v2_` prefix in its secret. Because Unleash never stores the complete token, it shows it only once, when you create it, so copy it straight into your secrets manager.

Tokens created in 8.2 or earlier are legacy tokens and keep working after you upgrade. To extend the protection to them, rotate each legacy token, including any set through the `INIT_*_API_TOKENS` environment variables. If you run Unleash Edge, upgrade to v20.5.0 or later for improved token telemetry.

Passwords have been hashed for decades, but across the industry API tokens are still mostly stored in full. With credential abuse showing up in a growing share of breaches, and a recent incident at a deployment platform where encrypted-at-rest secrets were still recovered by an attacker, we decided Unleash shouldn’t hold a copy of your tokens at all. We wrote up the reasoning, what the change does and doesn’t protect, and how to rotate in Why we’re doubling down on API token security.

Simplified Add strategy dialog

The Add strategy dialog now presents three options instead of a list of every strategy type: Use project default applies the default strategy for the environment, Set up manually opens the gradual rollout form (replacing the separate Standard and Gradual rollout strategies), and Start from a template applies a release template. The IPs and Hosts strategies and your custom strategies are still there under More strategies. See Strategy types.

Regex, IP address, and SemVer constraint operators

Three new constraint operators give you more precise targeting. The regex operator (beta) matches a context field against an RE2 regular expression, with a tester in the Admin UI so you can check sample values before you save. The IP address operator (beta) checks whether a field falls within a list of IPv4 or IPv6 addresses or CIDR ranges. And the SemVer operators now include `SEMVER_GTE` and `SEMVER_LTE`. Check SDK compatibility for the minimum SDK version per operator.

Delete tags

You can now delete a tag you no longer need from Configure > Tag types, or with the delete tag endpoint. The list shows how many flags use each value, and deleting a value removes it from every flag while leaving the tag type and its other values in place.

Flag links moved into Flag details

External links now live in a Resources section at the bottom of the Flag details panel on the flag’s Overview page. Everything else about links works as before.

Feedback reports from the MCP server

The Unleash MCP server can now send anonymous diagnostic reports when a tool call fails, returns an unexpected result, or you ask for something it can’t do yet. Reports never include flag names, project IDs, code, raw error messages, or tokens. The local server asks for your consent first, and an admin controls the setting for the remote server. See Send feedback.

Read the full 8.3 release notes →