[Added, Improved, Fixed] Security hardening & audio simulation (2026-10-23)

Added

Audio call simulations with degradation controls

Call Lab can now run interview simulations in full audio mode. Recruiters may introduce conditions such as packet loss, poor audio quality or connection drops to see how Joy copes with real-world issues. Text-only runs automatically reject these options, and audio simulations now have a 40-minute timeout so longer tests finish reliably.

Improvements

• Onboarding scripts now automatically take their title from the associated job, making them easier to recognise in the dashboard.
• The self-serve signup flow blocks attempts to join an organisation that has already been claimed, preventing accidental account clashes.
• Admin plan and billing pages enforce proper pagination and scope checks for a more consistent browsing experience.
• Billing requests are validated server-side, ensuring that plan IDs and screen quantities always match your organisation’s subscription.
• Both web apps run on Next.js 16.4.1, bringing minor performance gains and the latest security patches.
• The pre-commit secret scanner now flags Slack webhook URLs, reducing the risk of accidentally checking credentials into the codebase.

Fixes

• Resolved a bug that could trigger certain per-call webhooks twice, preventing duplicate notifications.
• Fixed a problem where fit-insights evaluations could hang indefinitely; they now time-out cleanly after 30 seconds.
• Corrected a rare 403 error that blocked the monthly overage-billing run from completing.
• Patched critical vulnerabilities in Next.js and DOMPurify that were causing failed deployments.
• Stopped audio simulations from being marked as degraded when they were actually run in text mode.
• Tightened token validation so QStash tokens can’t be reused on unintended endpoints.