Forgot password, sign-in by email link, duels on CySA+ and PenTest+, and achievements that count what they say
The login page gets two ways back in: a Forgot password link, and a sign-in link sent to your email. “Challenge a friend” after a campaign win now opens the Arena, and duels cover CySA+ and PenTest+. Achievements got a truth pass: three that could never be earned now can be, the Security+ domain badges count only Security+ practice-exam questions, and none of them claims XP it never gave. Your Stats page and the flashcard tutor now read your own cert's domains, and selling an item can no longer lose it.
Account
- NewForgot password. The login page has a “Forgot password?” link: enter your email, open the reset link we send, and set a new password.
- NewSign in without your password. On the login page, choose the email option and we send a link that signs you in on that device. It works for existing accounts only.
- FixedSign-in and sign-up errors now read as plain messages, such as “Incorrect email or password.” and “Choose a stronger password: longer, and not a common one.”, instead of the auth server's own wording.
- FixedPicking a class could switch your campaign to that class's cert, so someone who signed up for CySA+ or PenTest+ could end up on another cert. If you signed up for a cert, you now keep it, and the class picker says so.
- ImprovedWhen you signed up for a cert, the class picker opens with a class already suggested for it. One tap confirms, and you can still pick any class.
PvP
- Fixed“Challenge a friend” after a campaign win now opens the Arena with your battle's cert picked, on phones too. The old challenge links never reached the other player. They now open a page that says so and points to the Arena, where you can challenge anyone by name.
- ImprovedDuels now cover CySA+ and PenTest+. The Arena keeps the cert you duel in separate from the player list, so you can find a friend who studies a different cert.
- FixedPvP battles read the campaign's rare-drop guarantee but never used it up. Once you had won 20 campaign battles without a rare drop, every PvP battle that dropped loot gave you a guaranteed rare. PvP loot now rolls on its own odds, so expect fewer rares from PvP. The guarantee in the campaign works as before.
Achievements
- FixedThree achievements could never be earned: Persistent Learner, Comeback Kid and Night Owl. They can now, and their descriptions say exactly what they take.
- FixedThe Security+ domain badges now count only your Security+ practice-exam questions. Threat Hunter, Architect Novice (formerly Crypto Novice) and Security Sage each say how many questions they take. Badges you already earned stay earned.
- FixedLearning from Mistakes now unlocks on your first mistake review and Mistake Master on your tenth. Both used to unlock one review late.
- FixedDomain Specialist now means finishing every practice exam in one domain of one cert, and it unlocks on the exam that completes the set. Marathon Runner unlocks on your fifth full exam of the day and counts only full exams.
- FixedThe results screen and the Trophy Shelf showed an XP reward next to achievements, but an achievement never added XP. They are badges, and both places now show them that way.
Stats and study
- FixedSkill Coverage on your Stats page now shows your own cert's domains and answers. Answers from other certs no longer land in its bars, and CySA+ and SecAI+ show their own four domains.
- FixedThe flashcard tutor's mastery numbers now count only the card's own cert.
- Fixed21 Security+ practice exams were listed under General Security Concepts. They now sit under their own domains: Threats, Vulnerabilities, and Mitigations, and Security Program Management and Oversight.
- FixedThe map and the flashcard forge open on your own cert when you haven't picked one. They used to open on Security+.
Inventory and battles
- FixedSelling an item that took you up a level could remove the item and credit no XP. A sale now either completes in full or doesn't happen.
- FixedAfter a sale, the Sold message with the XP you got now stays on screen, with a line telling you when the sale took you up a level.
- FixedIn a rare case a campaign battle's XP was lost because the account's hero record was missing. The app now repairs the record and saves the battle.
Site
- FixedBlog posts and feature pages no longer promise ELO matchmaking, ghost battles or referral rewards that don't exist. In PvP you pick who you challenge, and you have an ELO rating. The copy now says so.
- ImprovedWe updated the framework the app runs on. It fixes at the source the lost clicks and the stuck Sign Out that 2.5.2 and 2.5.3 worked around.