FAQ & Knowledge Base v6.1.6

Release Date: August 26, 2026 Tags: MOBILE, KYC, CONTENT, COMPLIANCE

Overview

Asking the help centre a question no longer requires identity verification. On an install with KYC enforcement switched on, a customer could not ask for help until they had submitted identity documents — which is exactly backwards, because the customers most likely to need help are the ones stuck partway through verification.

It is also a data-minimisation problem and an app-review problem: identity has nothing to do with asking a question, and a reviewer cannot exercise a form that demands KYC first, so the feature reads as broken. Asking is still authenticated and still rate-limited, which is what the abuse concern actually needs.

The other change is for operators publishing an app. A help-centre answer is HTML an operator types in after the app has shipped, which makes it the one part of a compiled app that a remote-content rule can still reach. Requires Core v6.7.2.

Update Instructions

pnpm updator

Restart the backend. There is no database change and no configuration.

Removed

• Removed the KYC requirement on submitting a question. Asking for help is not a financial operation and never needed one.

Changed

Answers reach the app without embedded documents or outbound links

• Changed FAQ answers served to a native app client to have <iframe> and outbound links removed. An embedded frame is a whole other document chosen after review, and a link is the most likely place an operator writes "pay on our website" — which is itself the violation regardless of what is on the other end.
• Web output is unchanged, byte for byte. Both are legitimate on the web and every existing screen depends on them.
• This is not an XSS filter and does not replace one; the sanitiser that handles that runs as well, on both sides of the render.