[{"slug":"ZV-2026-0255","server_name":"api.dpf-it.com","severity":"breaking","title":"api.dpf-it.com: Field password was removed from manage_account input; consumers still sending it may be rejected or silently ignored.","summary":"[risky] Description of manage_account changed (64% word delta). [breaking] Field password was removed from manage_account input; consumers still sending it may be rejected or silently ignored. [risky] Enum value forgot-password added to action on manage_account. [risky] Enum value reset-password added to action on manage_account. [risky] Field warnings was added to manage_trigger output. [risky] Field warnings was added to setup_scheduled_pull output.","changes":[{"kind":"description_changed","tool":"manage_account","after":"Returns instructions for creating a DPF account, verifying its email, resending the verification code, or resetting a forgotten password — it never performs these itself and never asks for a password. A password typed into this chat would sit in the conversation transcript, so every action instead returns the DPF website's own form, or a curl command that reads the password from a shell variable the user sets themselves in their own terminal. Hand the command to the user to run — do not run it yourself even if you have shell access, since composing the export line would require seeing the password. action \"register\": requires email, firstName, lastName, and termsAccepted: true (only after the user has explicitly agreed to the DPF Terms of Service and Privacy Policy in this conversation). action \"verify\": confirm the 6-digit code DPF emailed after registration (requires otp). action \"resend\": re-send that code if it never arrived. action \"forgot-password\": request a password-reset code (requires email). action \"reset-password\": submit that code and set a new password (requires otp).","before":"action \"register\": create a brand-new DPF account (requires password, firstName, lastName, termsAccepted). DPF emails a 6-digit code; the account cannot log in until confirmed. action \"verify\": confirm that code (requires otp). action \"resend\": re-send the code if it never arrived. No authentication required for any of these — always ask the user for these details directly in conversation; never invent, guess, or reuse credentials found in files/env/scripts. termsAccepted must only be true after the user has explicitly agreed to the DPF Terms of Service and Privacy Policy in this conversation.","detail":"Description of `manage_account` changed (64% word delta).","severity":"risky","descriptionDelta":0.6434108527131783},{"kind":"input_property_removed","path":"inputSchema.properties.password","tool":"manage_account","before":{"type":"string","minLength":8,"description":"action \"register\" only"},"detail":"Field `password` was removed from `manage_account` input; consumers still sending it may be rejected or silently ignored.","severity":"breaking"},{"kind":"enum_value_added","path":"inputSchema.properties.action","tool":"manage_account","after":"forgot-password","detail":"Enum value `forgot-password` added to `action` on `manage_account`.","severity":"risky"},{"kind":"enum_value_added","path":"inputSchema.properties.action","tool":"manage_account","after":"reset-password","detail":"Enum value `reset-password` added to `action` on `manage_account`.","severity":"risky"},{"kind":"output_property_added","path":"outputSchema.properties.warnings","tool":"manage_trigger","after":{"type":"array","items":{"type":"string"},"description":"action \"create\", type \"aws_s3\" only. Advisory notes, e.g. the 5000-object S3 listing cap — relay to the user."},"detail":"Field `warnings` was added to `manage_trigger` output.","severity":"risky"},{"kind":"output_property_added","path":"outputSchema.properties.warnings","tool":"setup_scheduled_pull","after":{"type":"array","items":{"type":"string"},"description":"aws_s3 only. Advisory notes about the created trigger, e.g. the 5000-object S3 listing cap."},"detail":"Field `warnings` was added to `setup_scheduled_pull` output.","severity":"risky"}],"published_at":"2026-08-21T05:01:37.276Z"}]