October 29, 2026 — Card Testing Mitigation Hotfix
==================================================

.. note::
   This release strengthens TouchPoint's protection against card testing, where automated scripts use a
   church's online giving pages to check whether stolen card numbers work. Your church's accepted payment
   types and giving page settings are now enforced when a payment is submitted, and every reCAPTCHA check
   is verified with Google. Donors giving normally should see no difference. It also adds a meeting date
   filter to the Data Warehouse API.

Giving — Accepted Payment Types and Giving Page Settings
--------------------------------------------------------

.. release-notes::

    - Change: Gifts, registration payments, saved payment methods and recurring gifts are now refused when they use a payment type your church does not accept for that kind of payment - for example, a card at a church that accepts bank accounts only, or a card on an involvement with **No Credit Cards** checked - with the message "This payment type is not accepted. Please choose a different payment method." Previously this was enforced only by the payment options the page displayed
    - Change: Apple Pay, Google Pay, PayPal and Venmo are no longer offered on a payment page that does not accept cards, since those wallets are paid by card
    - Change: Giving page settings are now enforced when a gift is submitted, not only by what the page displays: a page with **Require Login** set to True refuses gifts from someone who is not signed in ("Please sign in to give on this page."), a page accepts only the kinds of giving it offers (a pledge page cannot be used for a one-time gift), a disabled page accepts no gifts, and every gift must go to a fund the giving page offers

Giving — reCAPTCHA
------------------

.. release-notes::

    - Fix: Every reCAPTCHA check on giving pages, registration payments, prayer requests and account deletion requests is now verified with Google; a check that passed once is no longer accepted again for later submissions in the same browser session. Donors see no change, since each submission already runs a new check

API — Data Warehouse
--------------------

.. release-notes::

    - New: ``GET /v1/DataWarehouse/Meetings`` accepts a ``meetingDate`` parameter that returns meetings dated on or after the given date, ordered by meeting date; the existing ``modifiedDate`` parameter on this endpoint filters on the date the meeting was created