Signing in got simpler, and the site better protected

Signing in and creating an account are now one step

• Type your email, get the code, done. If you didn't have an account yet, one is created on the spot and you go straight into the first-time setup. No more "that email doesn't exist" dead end.
• The sign-in screen is the same for people with an account and people without one: it doesn't reveal who uses Quickrefs.
• In the extension, email sign-in works the same way.

A quick check that you're a person

• When you ask for an access code, Quickrefs checks through Cloudflare that you're not a bot. It is usually invisible; when it needs a click, a small box appears just above the blue button.
• This stops automated, bulk sending of codes to other people's addresses.
• In the extension, the check opens a small window on the site, solves itself and closes. You need the latest extension version to sign in by email — the stores update it on their own, within a few hours.

More protection on the site

• Quickrefs can no longer be opened inside other pages — the trick of hiding the site under a fake button so you click something you didn't mean to.
• Automated attempts to probe the site for vulnerable software are turned away at the door.
• The address of an unlisted collection no longer leaks to other sites when you click a link inside it.