diff --git a/website/docs/reference/cli-commands.md b/website/docs/reference/cli-commands.md
index bd670e9fdd87..404800a4c71f 100644
--- a/website/docs/reference/cli-commands.md
+++ b/website/docs/reference/cli-commands.md
@@ -134,7 +134,7 @@ Examples:
 ```bash
 hermes
 hermes chat -q "Summarize the latest PRs"
-hermes chat --provider openrouter --model anthropic/claude-sonnet-4.6
+hermes chat --provider openrouter --model anthropic/claude-sonnet-5
 hermes chat --toolsets web,terminal,skills
 hermes chat --quiet -q "Return only JSON"
 hermes chat --worktree -q "Review this repo and open a PR"
@@ -165,7 +165,7 @@ Per-run overrides (no mutation to `~/.hermes/config.yaml`):
 ```bash
 hermes -z "…" --provider openrouter --model openai/gpt-5.5
 # or:
-HERMES_INFERENCE_MODEL=anthropic/claude-sonnet-4.6 hermes -z "…"
+HERMES_INFERENCE_MODEL=anthropic/claude-sonnet-5 hermes -z "…"
 ```
 
 Same agent, same tools, same skills — just strips every interactive / cosmetic layer. If you need tool output in the transcript too, use `hermes chat -q` instead; `-z` is explicitly for "I only want the final answer".
diff --git a/website/docs/reference/faq.md b/website/docs/reference/faq.md
index fc199a509b72..6a6864bc02ce 100644
--- a/website/docs/reference/faq.md
+++ b/website/docs/reference/faq.md
@@ -109,7 +109,7 @@ Yes. Import the `AIAgent` class and use Hermes programmatically:
 ```python
 from run_agent import AIAgent
 
-agent = AIAgent(model="anthropic/claude-opus-4.7")
+agent = AIAgent(model="anthropic/claude-opus-4.8")
 response = agent.chat("Explain quantum computing briefly")
 ```
 
@@ -284,7 +284,7 @@ Make sure the key matches the provider. An OpenAI key won't work with OpenRouter
 hermes model
 
 # Set a valid model
-hermes config set HERMES_MODEL anthropic/claude-opus-4.7
+hermes config set HERMES_MODEL anthropic/claude-opus-4.8
 
 # Or specify per-session
 hermes chat --model openrouter/meta-llama/llama-3.1-70b-instruct
@@ -854,7 +854,7 @@ hermes config show | head -20
 hermes model
 
 # Or test with a known-good model
-hermes chat -q "hello" --model anthropic/claude-opus-4.7
+hermes chat -q "hello" --model anthropic/claude-opus-4.8
 ```
 
 If using OpenRouter, make sure your API key has credits. A 400 from OpenRouter often means the model requires a paid plan or the model ID has a typo.
diff --git a/website/docs/reference/model-catalog.md b/website/docs/reference/model-catalog.md
index 4769a720c8f1..949f84a5d5b9 100644
--- a/website/docs/reference/model-catalog.md
+++ b/website/docs/reference/model-catalog.md
@@ -38,7 +38,7 @@ Published on every merge to `main` via the existing `deploy-site.yml` GitHub Pag
       "metadata": {},
       "models": [
         {"id": "z-ai/glm-5.2", "default": true},
-        {"id": "anthropic/claude-opus-4.7"},
+        {"id": "anthropic/claude-opus-4.8"},
         {"id": "moonshotai/kimi-k3"}
       ]
     }
diff --git a/website/docs/reference/slash-commands.md b/website/docs/reference/slash-commands.md
index c5f646fa6acb..62cc01a666a4 100644
--- a/website/docs/reference/slash-commands.md
+++ b/website/docs/reference/slash-commands.md
@@ -182,7 +182,7 @@ Two config formats are supported:
 ```yaml
 model_aliases:
   fav:
-    model: claude-sonnet-4.6
+    model: claude-sonnet-5
     provider: anthropic
   grok:
     model: grok-4
diff --git a/website/docs/user-guide/configuration.md b/website/docs/user-guide/configuration.md
index 4a97edca6825..3dcff8d5cd49 100644
--- a/website/docs/user-guide/configuration.md
+++ b/website/docs/user-guide/configuration.md
@@ -740,7 +740,7 @@ agent:
 This applies **after** per-platform tool config (`platform_toolsets` written by
 `hermes tools`), so a toolset listed here is always removed — even if a
 platform's saved config still lists it. Use this when you want a single
-switch for "turn X off everywhere" rather than editing 15+ platform rows in
+switch for "turn X off everywhere" rather than editing per-platform rows in
 the `hermes tools` UI.
 
 Leaving the list empty, or omitting the key, is a no-op.
diff --git a/website/docs/user-guide/features/kanban.md b/website/docs/user-guide/features/kanban.md
index 8e5859a3bed4..b3b84d75539f 100644
--- a/website/docs/user-guide/features/kanban.md
+++ b/website/docs/user-guide/features/kanban.md
@@ -859,7 +859,7 @@ Gateway platforms have practical message-length caps. If `/kanban list`, `/kanba
 
 ### Autocomplete
 
-In the interactive CLI, typing `/kanban ` and hitting Tab cycles through the built-in subcommand list (`list`, `ls`, `show`, `create`, `assign`, `link`, `unlink`, `claim`, `comment`, `complete`, `block`, `unblock`, `archive`, `tail`, `dispatch`, `context`, `init`, `gc`). The remaining verbs listed in the CLI reference above (`watch`, `stats`, `runs`, `log`, `assignees`, `heartbeat`, `notify-subscribe`, `notify-list`, `notify-unsubscribe`, `daemon`) also work — they're just not in the autocomplete hint list yet.
+In the interactive CLI, typing `/kanban ` and hitting Tab cycles through the built-in subcommand list (`list`, `ls`, `show`, `create`, `assign`, `link`, `unlink`, `claim`, `comment`, `complete`, `block`, `unblock`, `archive`, `tail`, `dispatch`, `context`, `init`, `gc`). The remaining verbs listed in the CLI reference above (`watch`, `stats`, `runs`, `log`, `assignees`, `heartbeat`, `notify-subscribe`, `notify-list`, `notify-unsubscribe`, `daemon`) also work — they're just not in the autocomplete hint list.
 
 ## Collaboration patterns
 
diff --git a/website/docs/user-guide/messaging/index.md b/website/docs/user-guide/messaging/index.md
index 61c47d5a421c..b436eb97ebcb 100644
--- a/website/docs/user-guide/messaging/index.md
+++ b/website/docs/user-guide/messaging/index.md
@@ -323,8 +323,8 @@ Details:
 # Restrict to specific users (recommended):
 TELEGRAM_ALLOWED_USERS=123456789,987654321
 DISCORD_ALLOWED_USERS=123456789012345678
-SIGNAL_ALLOWED_USERS=+155****4567,+155****6543
-SMS_ALLOWED_USERS=+155****4567,+155****6543
+SIGNAL_ALLOWED_USERS=+15550123456,+15550987654
+SMS_ALLOWED_USERS=+15550123456,+15550987654
 EMAIL_ALLOWED_USERS=trusted@example.com,colleague@work.com
 MATTERMOST_ALLOWED_USERS=3uo8dkh1p7g1mfk49ear5fzs5c
 MATRIX_ALLOWED_USERS=@alice:matrix.org
diff --git a/website/docs/user-guide/messaging/signal.md b/website/docs/user-guide/messaging/signal.md
index 597a7fa30be2..259fc3c059d8 100644
--- a/website/docs/user-guide/messaging/signal.md
+++ b/website/docs/user-guide/messaging/signal.md
@@ -194,7 +194,7 @@ You can still see tool activity in the CLI, and final Signal replies can include
 ### Phone Number Redaction
 
 All phone numbers are automatically redacted in logs:
-- `+15551234567` → `+155****4567`
+- `+15551234567` → `+15550123456`
 - This applies to both Hermes gateway logs and the global redaction system
 
 ### Note to Self (Single-Number Setup)
diff --git a/website/docs/user-guide/messaging/sms.md b/website/docs/user-guide/messaging/sms.md
index 8878cc5f0ab5..43b409bd4e4c 100644
--- a/website/docs/user-guide/messaging/sms.md
+++ b/website/docs/user-guide/messaging/sms.md
@@ -108,7 +108,7 @@ hermes gateway
 You should see:
 
 ```
-[sms] Twilio webhook server listening on 127.0.0.1:8080, from: +1555***4567
+[sms] Twilio webhook server listening on 127.0.0.1:8080, from: +15550123456
 ```
 
 If you see `Refusing to start: SMS_WEBHOOK_URL is required`, set `SMS_WEBHOOK_URL` to the public URL configured in your Twilio Console (see Step 3).
diff --git a/website/docs/user-guide/security.md b/website/docs/user-guide/security.md
index 59fde9033a35..7c5973ae10d0 100644
--- a/website/docs/user-guide/security.md
+++ b/website/docs/user-guide/security.md
@@ -722,6 +722,10 @@ Blocked files show a warning:
 9. **Monitor logs** — check `~/.hermes/logs/` for unauthorized access attempts
 10. **Keep updated** — run `hermes update` regularly for security patches
 
+:::tip Egress credential-injection proxy
+For Docker backends, the [egress proxy](/user-guide/egress/iron-proxy) keeps your real API keys out of the sandbox entirely: the container only sees opaque proxy tokens that resolve against a local TLS-intercepting daemon on the host. Setup is `hermes egress setup && hermes egress start`. **Note:** currently wired for the Docker backend only — Modal, SSH, Daytona, and Singularity are not supported yet.
+:::
+
 ### Securing API Keys
 
 ```bash
diff --git a/website/docs/user-guide/skills/optional/productivity/productivity-telephony.md b/website/docs/user-guide/skills/optional/productivity/productivity-telephony.md
index d3f6b81adaf8..2d9e64cab9c8 100644
--- a/website/docs/user-guide/skills/optional/productivity/productivity-telephony.md
+++ b/website/docs/user-guide/skills/optional/productivity/productivity-telephony.md
@@ -315,7 +315,7 @@ Use this when:
 Generate or host audio separately, then:
 
 ```bash
-python3 "$SCRIPT" twilio-call "+155****0000" --audio-url "https://example.com/briefing.mp3"
+python3 "$SCRIPT" twilio-call "+15550120000" --audio-url "https://example.com/briefing.mp3"
 ```
 
 Recommended Hermes TTS -> Twilio Play workflow:
diff --git a/website/docs/user-guide/windows-native.md b/website/docs/user-guide/windows-native.md
index de369fc08af8..ff509e8a8589 100644
--- a/website/docs/user-guide/windows-native.md
+++ b/website/docs/user-guide/windows-native.md
@@ -90,7 +90,7 @@ Everything except the dashboard's embedded terminal pane runs natively on Window
 |---|---|---|
 | CLI (`hermes chat`, `hermes setup`, `hermes gateway`, …) | ✓ | ✓ |
 | Interactive TUI (`hermes --tui`) | ✓ | ✓ |
-| Messaging gateway (Telegram, Discord, Slack, WhatsApp, 15+ platforms) | ✓ | ✓ |
+| Messaging gateway (Telegram, Discord, Slack, WhatsApp, 30+ platforms) | ✓ | ✓ |
 | Cron scheduler | ✓ | ✓ |
 | Browser tool (Chromium via Node) | ✓ | ✓ |
 | MCP servers (stdio and HTTP) | ✓ | ✓ |
diff --git a/website/scripts/fix-masked-phones.py b/website/scripts/fix-masked-phones.py
new file mode 100644
index 000000000000..b1e237b4b1ea
--- /dev/null
+++ b/website/scripts/fix-masked-phones.py
@@ -0,0 +1,40 @@
+#!/usr/bin/env python3
+"""Replace masked example phone numbers with valid fictional E.164 numbers.
+
++155****4567 -> +15550123456  (555-01xx is the FCC-reserved fictional range)
++155****6543 -> +15550987654
++155****3456 -> +15550123456
++155****2222 -> +15550122222
++155****0000 -> +15550120000
++1555***4567 -> +15550123456
+"""
+import re
+from pathlib import Path
+
+ROOT = Path(__file__).resolve().parent.parent / "docs"
+
+MASKED = {
+    "+155****4567": "+15550123456",
+    "+155****6543": "+15550987654",
+    "+155****3456": "+15550123456",
+    "+155****2222": "+15550122222",
+    "+155****0000": "+15550120000",
+    "+1555***4567": "+15550123456",
+}
+
+pat = re.compile("|".join(re.escape(k) for k in MASKED))
+
+changed = []
+for p in sorted(ROOT.rglob("*.md")):
+    try:
+        t = p.read_text(encoding="utf-8")
+    except Exception:
+        continue
+    new = pat.sub(lambda m: MASKED[m.group(0)], t)
+    if new != t:
+        p.write_text(new, encoding="utf-8")
+        changed.append(str(p.relative_to(ROOT)))
+
+print(f"Fixed {len(changed)} files")
+for c in changed:
+    print(" ", c)