Changelog

Confirm it's you before adding a passkey

A passkey signs you in in one step, so Add a passkey in Settings → Security now asks you to Confirm it's you first: the code from your authenticator app (or a backup code) if two-factor is on, otherwise your password. If you sign in only with an email link or Google, Microsoft or Apple, you're asked to Sign in again, and come straight back to Settings → Security afterwards. Once you've confirmed, you can add passkeys for the next ten minutes without being asked again. Someone who finds you signed in on a shared computer can no longer add a passkey of their own.

Confirm it's you before setting your first password

If you sign in with an email link, Google, Microsoft, Apple or a passkey, Set a password now asks you to confirm it's you too — usually by signing in again, unless you signed in within the last ten minutes.

An email whenever a passkey or a password is added

We email you each time a passkey is added to your account, with its name and when, and when a password is added to an account that didn't have one. If it wasn't you, remove the passkey in Settings → Security, or reset your password from the sign-in page, which signs out every device.

Due soon and overdue

Two new When blocks: Due date is near (choose a window from an hour to a week) and Record becomes overdue. Threadwork checks every hour and acts once per record for each due date — move the date and the rule can act again. Only open records count; your own rules look at records assigned to you. A new ready-made rule, Overdue records become Urgent, raises the priority and pins the record. These runs are listed on the Activity tab as On the hourly due-date check.

Automations opens in the board

The Automations button on a context's toolbar now opens the rules in the board's own frame: the toolbar, the breadcrumb and the rail on the left stay, so one click on a rail, a crumb or Back to the board returns you to where you were. Switching context shows that context's rules.

Guests' changes only take a rule's tag steps

A guest can tag a record but not resolve, move, reprioritise, pin or assign it — and now a rule set off by a guest's change can't either: it takes only its tag steps and says which it skipped. No rule ever makes a guest the assignee.

Trusted devices are forgotten when your password or two-factor changes

Resetting or changing your password, or setting up or turning off two-factor authentication, now forgets every device you ticked Trust this device on, so each one asks for your code again.

Microsoft connects only with a verified address

Signing in with Microsoft connects to an existing Threadwork account only when Microsoft confirms the email address is verified. Google and Apple are unchanged.

When this happens, do that

Open Automations from a context's toolbar and build a rule from three kinds of block: When (a record is created, resolved, reopened, tagged, untagged, moved, assigned, or its priority changes), If (it has a tag, is in a list, has a priority, is assigned, is open) and Then (remove all its tags, add or remove a tag, move it to a list, resolve or reopen it, set its priority, assign or unassign it, pin it). Drag blocks onto the canvas or click to add them; the rule reads back as a sentence as you build it. Four ready-made rules get you started, including Clear tags when a record is resolved and Tagging WIP moves it to In Progress.

Your own rules, and rules for everyone

Anyone except a guest can make rules of their own for a context — they run only when you change a record there, and nobody else sees them. Owners and admins can set organisation rules that run for everyone, in one context or in every context; everyone can see those on the Organisation tab. A list can be named rather than picked — In Progress means the In Progress next to the record's own list — so one rule works in every project.

See every rule that runs

When a rule changes a record, a message at the top right says which rule ran, on which record, and what it did — or why it couldn't. The Activity tab keeps the latest runs.

Clear tags on resolve is now an automation

The Clear tags when a record is resolved switch has moved from Settings → Team to Automations, as an organisation rule. If your team had it on, the rule is already there and switched on — and it now also works when you resolve a record from the board, where the old switch didn't.

Show the password you're typing

Every password field has an eye at the end — signing in, choosing a new password from a Forgot password? email, Set a password, Change password, and confirming your password for two-factor. Click it to see what you've typed; the password is hidden again as soon as you submit. Password managers can now also tell the field for your saved password from the one for a new password.

How easy is your new password to guess?

Wherever you choose a new password, bars under the field show how easy it would be to guess, with a sentence saying why — a common word with a capital and a number added, say, or your own name or email. It is advice, not a rule: any password from 8 to 128 characters is accepted, and a few unrelated words together are both strong and easy to remember.

Your two-factor code after an email link or a Google sign-in too

With two-factor authentication on, signing in with an email sign-in link, or with Google, Microsoft or Apple, now asks for the code from your authenticator app, just as signing in with your password does. Before, email sign-in links were turned off for your account, and Google, Microsoft and Apple sign-in skipped the code. Trust this device works for every kind of sign-in, and signing in with a passkey is still one step.

Passkeys work however the site's address is set up

Adding a passkey, or signing in with one, could fail with an error if the site's own web address was set up with a slash at the end. Passkeys now work either way.

Trusting a device lasts 30 days

The two-factor sign-in screen said Trust this device lasts 60 days. It lasts 30, and now says so.

Your password takes you straight to the code screen

With two-factor authentication on, signing in with Use a password instead now goes straight on to Enter your code. Before, the sign-in form also tried to open your dashboard at the same moment, so on a slow connection the sign-in page could come back for a few seconds before the code screen appeared.

Resetting your password signs out every device

When you choose a new password from a Forgot password? email, every device signed in to your account is signed out — including any you don't recognise. Sign in again with the new password.

Changing your password always signs out your other devices

Settings → Security → Change password keeps you signed in where you are and signs out every other device, every time.

Administrators must use two-factor authentication

Threadwork's platform administrators — the staff who run the service, not the owners and admins of your organisation — now need two-factor authentication to use the admin panel. An administrator without two-factor will be asked to set it up on their next visit to an admin page, under Settings → Security → Two-factor authentication; everything else keeps working meanwhile. The panel also needs a sign-in that used the authenticator code or a passkey, so an administrator signed in with Google or an email link is asked to sign in again that way. The same goes for adding a passkey, or changing or turning off two-factor, on an administrator account — setting two-factor up for the first time works from any sign-in.

A limit on how fast admin changes can be made

Plan changes, AI rate changes and re-pricing are limited to twenty in ten minutes for each administrator.

A change you saved no longer springs back

Set a Status and then a Priority, tick two checklist items, or tap a favourite star twice, and both changes stick. Before, whichever save the server answered last decided what you saw, so the first could reappear just after you watched the second one save. If one of two changes is refused, only that one goes back now, and the other is left alone.

The top bar fits every screen

On a phone, a tablet or a narrow laptop window the page no longer scrolls sideways. Below a full laptop width the navigation sits in a strip under the top bar — Favourites included, at its end — and the context name shortens to fit. On a phone, Dark mode / Light mode is in your account menu.

Search on a phone

A magnifying glass in the top bar opens search on phones and smaller screens, where there is no ⌘K to press.

Assigning a record takes an owner, an admin or one of its managers

Being a record's assignee lets that person see and edit it, so choosing the assignee is now always a decision for an owner, an admin or one of the record's managers — as it already was on the board. If you're a member and want a record assigned, ask one of them. Anyone who can edit a record can still clear its assignee.

Quick checklist ticks all stick

Ticking two checklist items in quick succession could save only the first. The next item now waits the moment it takes the first to save.

A full security review

Sign-in redirects accept only pages on Threadwork, guests can no longer create workspaces, reordering a board checks every card, and the site sends stricter security headers. The framework underneath is on its latest release.

New updates never hide in ones you've read

A reply arriving the moment you opened a thread could be folded into the update you had just read, so it never showed as new. It now arrives as an update of its own.

Plan changes in your audit log

Owners and admins now see every change to the team's plan in Team → Audit log: moving between Free, Pro and Business, switching between monthly and annual billing, a subscription falling past due or being cancelled, and the number of paying seats going up or down as people join, leave or become guests. Each entry says what changed and whether it came from your subscription, from your own team, or from a Threadwork administrator — with the reason they gave.

A precise billing record

Threadwork now keeps a dated history of each team's plan and seats, so a billing question — what you were on, from when, and for how many people — has an exact answer.

A progress bar for the page you asked for

A slim bar runs across the top while the next screen loads, and the link or button you clicked shows a small spinner, so it is always clear which one took. It waits a moment before appearing, so a quick page never flashes it.

Changes show straight away

Ticking a checklist item, giving kudos, raising a flag, reacting, pinning, editing a post, changing a record's Status, Stage, Assignee, Priority or dates, sending a room message, tagging, following, favouriting, dragging a card and resolving a task all show at once instead of after a wait. If the change can't be saved, it is undone in front of you and a message says why.

Bulk changes now tell you when they fail

Resolve all, Pin, Delete and the Resolve all overdue button on your home screen showed the work as done whether or not it saved, and said nothing when it didn't. Anything that is refused now comes back with a message naming the reason.

A dragged card on a view's board no longer jumps

On a Kanban view of a context, a card dropped into another column snapped back to where it started and then jumped across a moment later. It now stays where it was put.

Shared groundwork

The optimistic updates, pending state and navigation feedback are now the shared ones used across our apps, so they behave the same everywhere.

One update per record or room

A run of replies, mentions, kudos or room messages about the same record or room now shows as a single unread update, refreshed with the latest and moved to the top, instead of a new line each time. Once you've read it, the next one starts a fresh update.

Opening it clears it

Opening a record — on its own page or beside the board — or a room marks your updates about it as read, and the bell's count catches up. Opening Invitations or People does the same for invitation updates.

Step-by-step forms explain why they won't save

New record, New group and Team settings could refuse to save with nothing on screen to say why — for example a prefix with a hyphen, a very long brief, or a team name cleared before jumping to Review. Continue now checks the step you're on, and saving checks every step and takes you to the one that needs fixing, with its message.

Set up a structure says what's missing

In Set up a structure, Continue now tells you what's missing — a template, a name or a blank layer — instead of staying greyed out. Steps you've reached stay clickable, so you can move back and forth.

Guide tables show as tables

Six guides — including Settings, Visibility groups and Invitations — showed their troubleshooting tables as rows of pipe characters. They now show as proper tables with a header row.

Every release has a number

Each release now shows its version, whether it was a major, minor or patch release, and its date. Changes are grouped by area and tagged New, Improved, Changed or Fixed, and the list of releases takes you straight to one.

Shared building blocks

The help centre's guides and this page now share their code with our other products, so an improvement to one reaches them all.

Named groups of people

Build named groups of people (e.g. Leadership, Design team) in Settings → Visibility groups.

Share a private workspace with a group

Share a private workspace with a whole group — everyone in it can open the workspace, on top of its direct members.

One place to change who is in a group

Change a group's membership in one place and access updates everywhere it's used.

Your own nested contexts

Define your own nested contexts with a typed schema — text, number, date, yes/no, person or select fields.

Grid, kanban and list views

Fill in records and view them as a grid, kanban or list, with inline cell editing in the grid.

Arrange a context your way

Reorder properties, elements, options and layers, and search or hide columns within a view.

Hours and cost budgets

Set hours and cost budgets on a project or workspace, with weekly/monthly/total tracking.

Budget change requests and subcontractor costs

Request a budget change for an owner/admin to approve, and track external subcontractor costs against it.

Richer breakdowns with CSV export

Reports break time down by workspace, project, person, thread and tag — filterable and CSV-exportable.

Block-based posts

Block-based posts with a slash menu, reply chains, reactions, kudos and flags.

Disappearing posts

Disappearing posts that auto-clear after 1h/24h/7d unless the team engages (pinned, tagged, reacted or replied).

Mentions for people, work and dates

Mention people, threads, workspaces, projects and even dates with @-autocomplete.

Workspaces, projects and threads

Workspaces, projects, threads and a kanban/list board with drag-and-drop.

Time tracking, favourites, rooms and a command palette

Time tracking with billable/approved states, favourites, rooms for quick huddles, and a ⌘K command palette.

Private workspaces, roles and invitations

Private workspaces, roles, invitations and multi-team membership.