# Upgrade Guide — v0.23.1

<!-- bump: patch -->

## What Changed

**AuthGate default flipped from allow-all to deny-all when no authorized users are configured.**

Previously, `AuthGate.isAuthorized()` returned `true` when the `authorizedUsers` set was empty (size === 0). This dangerous default caused a critical bug where a WhatsApp-connected agent with no `authorizedNumbers` configured responded to every incoming message on the account — including personal conversations with unrelated contacts.

Now:
- Empty `authorizedUsers` = deny all (safe default)
- To explicitly allow all users, include `'*'` in the authorized list (e.g., `authorizedNumbers: ['*']`)
- WhatsApp adapter logs a console warning when started with no `authorizedNumbers`

**Migration impact**: Any agent config with empty or missing `authorizedNumbers` will now correctly reject all messages. Agents that intentionally accept messages from anyone must add `'*'` to their authorized list.

## What to Tell Your User

- **Security fix**: "I've tightened up who can message me. Previously if no allowed contacts were set, I'd respond to everyone — now I only respond to contacts you've specifically approved. This prevents me from accidentally responding to messages meant for you."

## Summary of New Capabilities

| Capability | How to Use |
|-----------|-----------|
| Safe default authorization | Automatic — empty config now denies all |
| Wildcard authorization | Add a wildcard entry to your allowed contacts to accept everyone |
| Missing config warning | Automatic — console warning on startup if no contacts configured |
