Opensolr Changelog

Scoped API keys — stop sharing your master key. You can now create additional API keys from Account › API Keys, each restricted to exactly the endpoints you tick and, optionally, to a chosen subset of your indexes. Give a developer search-only access to one index, give your CI pipeline Data Ingestion rights and nothing else, or hand a contractor a key that expires on a date you choose. Keys can be revoked or regenerated instantly, and your master key — which is root-level and doubles as the initial index password — never has to leave your hands. Details in the Security & Trust Center.

Service availability by country. For security and compliance reasons, Opensolr accounts can no longer be created from, and payment methods can no longer be added from, the following countries: Albania, Bangladesh, Belarus, Bulgaria, Cambodia, Hong Kong, Indonesia, Iran, Iraq, Israel, Japan, Kuwait, Liechtenstein, Moldova, Pakistan, Romania, Russia, Singapore, Switzerland, Syria, Turkey, Ukraine, and Vietnam. Existing accounts are not affected. If you are based in one of these countries and you need an Opensolr index, this is not a final no — please reach out to us directly through our contact page and we will review your case individually and set your account up by hand.

New Security & Trust Center. Read how Opensolr protects your data — our security controls mapped to the SOC 2 Trust Services Criteria and ISO 27001, with a downloadable overview for your vendor security reviews. Visit the Trust Center.

Fleet-wide Solr security hardening. We have patched a potential security issue affecting older Apache Solr versions and strengthened server-side request controls across our entire Solr infrastructure. The update was rolled out to every server automatically — no customer action is required, and your indexes and data are unaffected.

3-round security audit on the Drupal module: XSS protection on AI streaming output (DOMParser sanitizer), Solr injection prevention on range filters and facet values, CSRF on all admin write endpoints, and safe URL generation in CLI/cron context. 35+ issues found and fixed across all module files.