Release Notes

What changed in each version of Secret Keybox, and what to check before you upgrade. Questions? Email contact@secretkeybox.com.

Version 2.4.1 released 11 September 2026

Wording fixes in the SKB Admin tab. The Health check now lists the missing picklist values per field, ready to copy, and names the Credential Access Log object and the Setup path correctly.

Version 2.4 released 7 September 2026

This version adds a full access log, blocks "Login As" abuse, and manages credentials when a user leaves.

After you upgrade

Open the SKB Admin tab. Its Setup card tells you what to do. Permission sets update on their own; there is nothing to assign.

Add the missing picklist values. A package upgrade cannot add values to a picklist that already exists in your org. The Health check names the values your org is missing on the Credential Access Log object, in its Action and Cause fields. To add them: Salesforce Setup, Object Manager, Credential Access Log, Fields & Relationships, open the field, then New in the Values section. The Health check lists each value after the name of its field. Enter the value only, without the field name and the colon: Share_Granted, not Action: Share_Granted. The log records every event either way; only report and list-view filters need the values.
Check log retention. After the upgrade the retention is 3 years (1095 days): entries older than that are removed nightly. Clear the field to keep every entry forever, or set another number of days. Nothing in your log is older than 3 years yet, so no entry is removed on the day you upgrade.
Review what you keep in Notes. Changes to Notes, Name, Username, and URL are logged with old and new values. Administrators with Secret Keybox Admin Access can read this history without opening the credential. Avoid sensitive text in Notes if that matters.
Set a fallback user so that the credentials of deactivated users have somewhere to go.
Reassign credentials in the app. Data Loader and Change Owner can no longer change a credential's owner. Use "Transfer ownership", or the transfer for deactivated users.

Access log

The log records every reveal, share, and access revocation. Revocations include manual unshare, share expiry, and user deactivation.
It records every ownership transfer and every change to Name, Username, URL, and Notes. Changes show the old and new value.
It records changes to the secret itself, but never the secret value.
Each entry shows who acted, which user is affected, the reason, and the group involved.
Reasons include joining or leaving a group, a group deletion, a user deactivation, or a share expiry.
Blocked "Login As" attempts appear in the log too.
Owners see their own credentials' log in a new Access log tab.
Administrators with the Secret Keybox Admin Access permission set see the log across the org, without opening any credential.
A "Credential Access Log" report type lets you build custom reports.
You set the log retention in the Setup tab. A blank value keeps the log forever. New installs and upgrades start at 1095 days (3 years).
A failed log write never blocks a reveal. The Setup tab counts such failures.

Login As protection

An administrator using "Login As" cannot reveal, edit, delete, share, unshare, or create a credential, and cannot transfer ownership.
The log records every blocked attempt made in the app. A block on a standard Salesforce record page shows an error and is not logged.
Bulk tools, such as Data Loader, integrations, and scheduled jobs, are not affected.

Credentials of deactivated users

When a user is deactivated, Secret Keybox can move their credentials to their manager (optional, off by default) or to a fallback user.
The receiving user must be active and hold a Secret Keybox permission set.
Credentials with no eligible recipient stay with the deactivated user. The Setup tab shows how many, and lets you transfer them once you set a recipient.
The log records every transfer, with the administrator who triggered it.

Setup tab

The card on the SKB Admin tab is now called Setup, with three parts: Health check, Configuration, and Danger zone.
Health check lists only the items that need attention, and confirms when everything is in order.
After an upgrade, Health check lists any access log picklist values missing from your org. See "After you upgrade" above.
The transfer for deactivated users moves up to 200 credentials per run and tells you when to run it again.

Other changes

The credential detail view has tabs: Details, Shares, and Access log.
Delete confirmations show the name you must retype, on its own line.
Error and warning messages stay on screen until you close them. Success messages disappear as before.
The app blocks owner changes made outside it, such as with Data Loader, Change Owner, or Flow. Use "Transfer ownership", or let automatic transfer handle deactivated users.

Version 2.3 released 4 September 2026

This release fixes issues reported by testers.

Fixes

The Save button always responds. If the form is incomplete, a message explains what is missing.
The URL field becomes a link only for http and https addresses. Other values save as plain text. Help text explains the format. A warning appears if your value will not become a link.
The credential detail view shows who a credential is shared with, including the user or group and any expiry date. Only the owner can see this.
We verified the upgrade path from version 2.2 to 2.3: scheduled jobs recreate automatically, and existing secrets stay encrypted.