CaseMark keeps its document vault out of the browser's reach
Two fixes close a gap where the keys to CaseMark's case-document store were briefly visible on the user's side.
When you open a document to review it, the fork now passes the file through its own server before sending it to you. Previously the browser got a short-lived signed link straight to Case Vault - CaseMark's case-document store - meaning the link, and the access it granted, flashed up in the browser where a curious user (or a compromised one) could grab it. Now that handoff stays server-side and the browser only ever sees the file itself.
The same release tidies up a settings screen that could momentarily flash a false "your API key is missing" warning before it had finished loading - a small thing, but the kind that generates support tickets. CaseMark flags one tradeoff worth a look on GitHub: documents now route through its server on every view, so anyone serving large files to a busy team should watch the memory cost.
Spotted something wrong? Or know the PR text has fresher detail than the writeup above?