v1.17.3 — the secret stops travelling, and a node stops being exhaustible A security release. Four findings from our own audit, one of them sitting in the deployment mode our documentation recommends. **The shared secret no longer leaves your machine.** In self-signed mode the client cannot verify the agent — the certificate is regenerated on every restart, on every node — and it used to send the secret anyway, to whatever server answered the connection. One capture was one credential valid on every node, each holding the Docker socket. The client now sends a proof derived from the secret and the certificate of the connection it is travelling on. A proof collected on an attacker's connection authenticates nowhere else, and there is nothing left on the wire to steal. Said plainly, because the opposite would be worse: this defeats theft and replay, not eavesdropping. On a connection you chose not to verify, whoever answers still sees what that session sends them. For an untrusted network, provision a CA. **A node can no longer be talked into exhausting itself.** Every port-forward connection creates a container, so "open many connections" meant "start many containers", with nothing stopping it. Two limits now: 256 concurrent streams and 64 live forward sidecars, the second deliberately tighter so the refusal lands before any container exists. Over the limit the agent refuses and names the flag to raise, rather than queueing — a queue turns a resource limit into a wait nobody can tell apart from a hang. Session timeouts, which shipped disabled, now default to 30 minutes idle and 12 hours total. **Listing containers is authorized and audited** like every other call. It was the one that asked neither, so a policy could never restrict discovery — the container ids and service names that exec, logs and port-forward take as input — and mapping a whole cluster left no record at all. Also here: the security overlay's escaping is now tested on the path that actually renders it, and release announcements are built as CI artifacts instead of drafts nobody could find. **Update the agents: `swarmexec init --force`.** A v1.17.3 client sends only the bound proof, so it cannot authenticate to an older agent. While a fleet is mixed, `legacy_secret: true` in the client config bridges the gap; drop it afterwards. Apache-2.0, self-hosted, no telemetry.