Core v6.6.6

Release Date: August 13, 2026 Tags: ACCOUNTS, PRIVACY, PROFILES, BLOG, DIAGNOSTICS, SYSTEM-HEALTH, BUG-FIXES

Overview

Usernames, and the end of showing one customer another customer's legal name. Everything this platform showed one user about another was built from their first and last name — the name on the document they uploaded for identity verification. It sat beside their live P2P offers, their payment rails and their trading volume, on pages that do not require an account to read. Every user can now set a handle, and that handle is what everybody else sees.

Accounts that have not set one are shown as a given name and an initial, so no install has to do anything for the exposure to stop. Read the Upgrade Notes before updating if anything you have built reads a customer's surname or email out of the blog, comment or author endpoints — those fields are no longer sent.

One diagnostic repair ships alongside: a refused blockchain endpoint reported only its status code, so a key restricted to another IP, a rate-limited public node and a dead host all read as HTTP 403 Forbidden. Operators running Ecosystem should read Ecosystem v6.4.2 beside this one.

Update Instructions

pnpm updator

Restart the backend afterwards. The user table gains a username column and a unique index, applied automatically on the first boot after updating. No script to run.

Upgrade Notes

What one customer sees about another is now a handle, not their real name

Until now the name on every public surface was firstName lastName. That is the name a customer enters for identity verification, and it was being published to strangers: on a blog post's byline, under every comment, on author pages, and on each of the peer-to-peer surfaces where somebody decides whether to send money to a person they have never met.

From this release, a user is introduced to other users by the username they chose. An account that has not chosen one is shown as a given name and an initial — Adebayo O. — which is what the surname was reduced to on trader reviews already. Nothing needs to be set for the change to take effect, and no existing account is renamed.

The real name has not moved anywhere else: the account holder still sees it on their own profile, operators still see it on every admin screen, and identity verification is untouched.

• Changed the name shown to other users, everywhere, to the account's username — or to a given name and an initial when it has none.
• Removed the surname and the email address from the blog, comment, author, tag and category endpoints. If you have built anything against those responses that reads lastName or email, it will now receive nothing.

Usernames are unique and cannot be taken back once an account is deleted

Uniqueness is case-insensitive, so GregMint and gregmint are one handle and one person. A deleted account keeps its handle rather than releasing it — a handle people have traded against must not become inheritable, and taking over the handle of an account that was removed is a worse failure than not being able to reuse a free one.

A short reserved list is refused outright — admin, support, staff, official, security and the like — because a trader who sees "support" in a chat has been told something false by the platform itself.

• Added a reserved-name list that refuses handles impersonating the platform or its staff.

Added

Usernames

• Added a Username field in Edit Profile → Basic Information. It checks availability as you type against the same rule the save applies, so a handle reported as free cannot be refused a moment later, and offers alternatives when one is taken — each of them checked before it is suggested.
• Added the same field to the mobile app's profile editor, with the same live check and suggestions.
• Added the ability to clear a handle and go back to a given name and an initial. Setting one is not a one-way door.

Fixed

System health

• Fixed a refused blockchain endpoint reporting only its status code. The explanation the endpoint returned in the response body was discarded, so HTTP 403 Forbidden was shown for a key restricted to another IP, for a rate-limited public node, and for a dead host alike.
• Fixed the status line rendering as HTTP 403 with a trailing space against endpoints served over HTTP/2, which carries no reason phrase.