> ## Documentation Index
> Fetch the complete documentation index at: https://docs.squared.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# August 2026 Releases

> Release updates for the month of August 2026

## 🔒 Security

* **Clickjacking protection for embedded published apps**
  Published Data Apps and Agentic Apps are now protected against clickjacking by enforcing a Content Security Policy `frame-ancestors` directive derived from each workspace's approved embed origins.
  * Added a `frame-ancestors` directive to responses served through the published app proxy, limiting embedding to `'self'` and the origins registered for the app's workspace
  * Added an embed-origins lookup endpoint that returns approved origins and propagation details for a workspace, with request coalescing, caching, timeouts, and safe fallbacks
  * Origin matching now supports exact, wildcard, and pattern-based entries so admins can allow entire subdomain trees or template-style origins
  * Default CORS access is restricted to approved domains and localhost, and the embed CORS bypass is disabled by default so the allow-list is always enforced
  * Added rate limiting for unauthenticated embed-origin lookups to prevent abuse of the public lookup endpoint