Run Your Store in Your Language, With Stronger Account Security
The Cartly admin panel now works in six languages — English, German, Spanish, French, Ukrainian, and Russian — and a wave of security hardening protects merchant logins, password resets, and customer accounts at checkout.
CT
Cartly Team
Engineering & Product
RELEASE
v1.29 · localization · security
This release makes Cartly easier to run day-to-day in two ways: the admin panel now speaks your language, and a broad round of security work hardens how logins, password resets, and customer accounts are protected.
Your admin panel, now in your language
The entire merchant admin is now available in six languages — English, German, Spanish, French, Ukrainian, and Russian. Every screen is covered: Dashboard, Orders, Products, Collections, Customers, Discounts, Apps, and all of Settings, along with the shared dialogs, forms, and toasts you use throughout the day.
To switch, open the language switcher at the bottom of the admin sidebar and choose your language. Your choice is saved to your account, so it applies on every device where you sign in. Numbers, plural forms, and interface text follow the conventions of the language you pick, and product and store content you have entered yourself is always shown exactly as you wrote it.
Stronger account and checkout security
We shipped a wave of security hardening across sign-in, password recovery, and checkout. The changes are transparent — there is nothing to configure — but they close several classes of abuse:
Password resets follow the account. A reset or email-verification link is always delivered to the address on the account it belongs to, never to an address chosen by the request. This removes a path an attacker could use to redirect a reset link.
Login rate-limiting by failure, per account. Repeated failures are throttled per account and per client rather than per network address, so a shared office or mobile network is no longer locked out because of unrelated traffic — while brute-force attempts against a single account are still blocked quickly.
Uniform responses everywhere. Sign-in, magic-link, and registration flows return the same response whether or not an account exists, and take the same time to do so. That closes account-enumeration and timing side channels a scanner could otherwise use to discover which emails have accounts.
Gift-card codes cannot be probed. We closed a balance-checking side channel so gift-card codes can no longer be tested for validity.
Smaller improvements
Consistent payment-method labels. Orders now use one canonical set of payment-method names across the admin, and mobile order lists show a compact preview of line items.
App Store "Top rated" sort. Sorting the App Store by "Top rated" now orders apps by their rating as expected.
Cleaner dashboard load. Fixed a charting warning that appeared on first render.