From 96377848332477f56a3e2ef11ab7ae36c675c2b7 Mon Sep 17 00:00:00 2001
From: mARTin-B78 <mail@martin-bierschenk.de>
Date: Fri, 4 Sep 2026 08:53:12 +0200
Subject: [PATCH] docs: record API key cache policy

---
 CHANGELOG.md | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index c047c5c..00084ab 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,8 @@ Follows [Keep a Changelog](https://keepachangelog.com/en/1.0.0/) · versioned wi
   prompt resolution, and per-form portrait/reference assets.
 
 ### Changed
+- **API Key Handoff Cache Policy.** Settings and explicit external-key regeneration responses now send `no-store`
+  headers so browser and intermediary caches cannot retain the client-visible access-key handoff.
 - **API Boundary Hardening.** External API authentication is enabled by default, request and mutation limits are
   enforced, and settings responses redact provider credentials for non-browser callers.
 - **Server-side Provider Credentials.** Provider keys are now masked even for same-origin Settings responses, are