Subscribers confirm before they are added

Leaving an address on your changelog now sends a confirmation link first, and the address joins your list only when someone follows it from that inbox. Nobody can sign a colleague up by typing in their address, and your list holds only people who asked to be on it.

Links in our emails also no longer do anything just by being opened. Company mail scanners open every link in a message before the reader sees it, which could confirm or unsubscribe someone who never clicked. Every link now lands on a page with a button instead.