Changelog

Showing 56 of 56 releases

1. Latest

   v0.16.17

   Oct 17, 2026Safer production configuration

   UpdateSecurity

   Reject insecure production provider connections at startup.

   security

   • Require encrypted connections for production identity and rate-limit providers while preserving local development support.SecurityInterface

2. v0.16.16

   Oct 15, 2026Accurate authenticator audit outcomes

   UpdateSecurity

   Record rejected authenticator and recovery-code attempts as failures.

   security

   • Correct audit outcomes for denied multi-factor verification without changing authentication protections.Security

3. v0.16.15

   Oct 15, 2026Reliable avatar updates

   Update

   Preserve your existing avatar if an image update cannot finish.

   fixed

   • Failed identity metadata synchronization no longer leaves the profile referencing a removed replacement image.Bug fix

4. v0.16.14

   Oct 15, 2026Account-link abuse protection

   UpdateSecurity

   Strengthen abuse protection when opening account-security links.

   security

   • Repeated account-link requests retain independent source and credential limits while preserving the normal verification ceremony.Security

5. v0.16.13

   Oct 15, 2026Isolated password recovery

   UpdateSecurity

   Keep recovery authority separate from ordinary signed-in sessions.

   security

   • Rejected recovery proofs and refused password updates retain failed audit outcomes without changing authorization or token safeguards.Security
   • Recovery credentials select the account being reset; ordinary callbacks and unrelated signed-in sessions cannot substitute for recovery authorization.Security
   • Concurrent recovery requests retain one current credential, and completed resets require committed session revocation and audit evidence.SecurityPerformanceInterface

6. v0.16.12

   Oct 14, 2026Security email configuration safeguards

   UpdateSecurity

   Keep security mail on the reviewed Mecrotis sender and application origin.

   security

   • Production mail rejects testing senders and obsolete or foreign action links, including queued legacy messages.SecurityBreaking
   • Delivery failures retain safe retry and audit state; account email tracing uses verified user identities.Security

7. v0.16.11

   Oct 14, 2026Authentication and database safeguards

   UpdateSecurity

   Bind security checks to their intended authentication flow and preserve database integrity.

   security

   • Authentication security checks reject missing action or hostname verification evidence.Security
   • Database maintenance hardening limits session and membership helpers to authorized application roles and protects retention checks from caller-controlled function lookup.Security
   • Billing and redemption retain their uniqueness protections with fewer redundant indexes.Security

8. v0.16.10

   Oct 13, 2026Session revocation consistency

   UpdateSecurity

   Keep revocation scope explicit and commit its audit before sign-out.

   security

   • Invalid logout scope cannot revoke a broader set of sessions; user-bound revocation and audit commit together before provider sign-out.Security

9. v0.16.9

   Oct 12, 2026Session authentication safeguards

   UpdateSecurity

   Require recent authentication from the session performing a sensitive action.

   security

   • Signing in on another device or refreshing a session cannot refresh an older session's sensitive-action authorization.Security
   • Record current-session revocation before provider sign-out and show failed logout without implying success.Security

10. v0.16.8

    Oct 11, 2026Sign-in lockout accuracy

    UpdateSecurity

    Prevent security-check and provider errors from causing password lockouts.

    security

    • Preserve password lockout for invalid credentials while keeping failed security checks denied and audited.Security

11. v0.16.7

    Oct 11, 2026Recovery email and password security

    Update

    Improved recovery of interrupted email deliveries and safe failure diagnostics.

    fixed

    • Recover expired final delivery attempts without sending extra email.Bug fix
    • Prevent delayed email workers from overwriting newer delivery claims.Bug fixNew
    • Record recovery delivery failures accurately while preserving private link data.Bug fix
    • Require an available security check before creating or replacing a password.Bug fixSecurityInterface

12. v0.16.6

    Oct 10, 2026Database connection lifecycle maintenance

    Update

    Improved cleanup of idle database connections when application instances pause.

    fixed

    • Registered database pools with the hosting platform's supported idle-connection lifecycle.Bug fix

13. v0.16.5

    Oct 10, 2026Simpler authentication entry

    Update

    Removed the extra browser checkpoint from customer sign-in, signup and password recovery.

    changed

    • Customer authentication retains its existing CAPTCHA and account-abuse protections without the additional browser checkpoint.Improved

14. v0.16.4

    Oct 5, 2026Authentication reliability and security maintenance

    UpdateSecurity

    Improved sign-in reliability, protected redirects and secure database connections.

    fixed

    • Preserved the intended destination through administrative sign-in and two-factor verification.Bug fix
    • Improved security challenge handling after unsuccessful sign-in attempts.Bug fixSecurity
    • Handled unavailable billing webhook configuration with a controlled failure response.Bug fix

    security

    • Strengthened authentication redirect validation and account-protection failure handling.Security
    • Preserved certificate verification across database connection configuration.Security
    • Updated image processing and build dependencies with published security fixes.SecurityBug fixInterface

15. v0.16.3

    Oct 5, 2026Bounded maintenance catch-up

    Update

    Scheduled maintenance distinguishes completed bounded work from remaining detection backlog.

    fixed

    • Successful bounded catch-up no longer produces a false execution failure or repeats completed work on delivery retries.Bug fix

    changed

    • Authenticated readiness reports detection coverage and remaining backlog separately from execution results.Improved

16. v0.16.2

    Oct 4, 2026Maintenance failure diagnostics

    Update

    Rejected maintenance requests now produce safe operator diagnostics while preserving authentication and private responses.

    fixed

    • Maintenance request failures now distinguish validation stages in server logs without recording sensitive request data.Bug fixInterface

17. v0.16.1

    Oct 4, 2026Administrative access correction

    UpdateSecurity

    Improved administrative request validation without changing public application links.

    fixed

    • Corrected request validation for separately configured administrative access.Bug fix

    security

    • Administrative requests remain subject to independent authentication and authorization checks.Security

18. v0.16.0

    Oct 4, 2026Delivery status and maintenance reliability

    Update

    Improved operational delivery reviews and maintenance progress tracking.

    added

    • Delivery reviews preserve failure history while distinguishing reviewed failures from new issues.NewInterface

    fixed

    • Corrected maintenance progress tracking during retries.Bug fix
    • Preserved delivery failure history during routine cleanup.Bug fix

19. v0.15.0

    Sep 8, 2026Enterprise configuration architecture

    Update

    Every operator-tunable policy now has one validated, typed home — session, lockout, tokens, retention, workers, billing — with drift-proof UI copy and zero client authority.

    added

    • Central policy catalog (config/policy.ts): session, lockout, token, recovery, retention, alert, database, email, AI-job, worker, upload, cache, and billing policy — every value documented with its security rationale and safe range.NewSecurity
    • Validated environment overrides for 40 policy knobs (POLICY_*): tune security posture without a deploy; invalid or unsafe values fail validation loudly.NewSecurity
    • Route constants (config/routes.ts): one authoritative definition for every repeated API path; renaming a route is now a one-line change.New
    • Policy-derived display copy (content/policyCopy.ts) with a sync script and drift tests — UI and email text about lifetimes can never silently disagree with enforcement.NewInterface
    • New developer documentation: configuration.md (where every setting lives and how to change it safely) and security-policy.md (the full policy reference).NewSecurity

    fixed

    • Password-create help text claimed 12 characters plus symbol rules; the server actually enforces 15 with no composition requirement. The UI now derives its text from the same authority the server enforces.Bug fixInterface
    • The one-time link lifetime (30 minutes) was independently hardcoded in five security flows, three email templates, and two pages — all now consume one policy value.Bug fixSecurityInterface
    • The 10-minute reauthentication window was computed twice; reactivate and verification guards now share one policy value.Bug fix
    • Removed dead configuration: an unused workspace-theme localStorage write, an unread CACHE_TTL_SECONDS constant, an unused mobile-breakpoint constant, and a misleading NEXT_PUBLIC_APP_NAME variable (the brand name lives in content/site.ts).Bug fix
    • Dashboard sample chart is now explicitly labeled as illustrative instead of implying live telemetry.Bug fixInterface

    changed

    • One-time credit-pack quantities are now environment-driven (POLAR_CREDITS_PACK_*) exactly like subscription plan credits, closing the ID-vs-quantity inconsistency.Improved
    • TOTP issuer now derives from the authoritative brand configuration instead of a hardcoded string.ImprovedBug fix
    • Version advanced to 0.15.0 across every surface; policy configuration carries its own independent version (1.0.0).Improved

20. v0.14.0

    Sep 6, 2026Complete security remediation

    UpdateSecurity

    Account lockout, session lifetime enforcement, tamper-evident audit, kill switches, passkeys, refund clawback, and detection that actually alerts.

    security

    • Account-keyed lockout with exponential backoff and CAPTCHA escalation stops credential stuffing even when attackers rotate IPs.SecurityPerformance
    • Sessions now carry a 30-day absolute cap, a 7-day idle timeout, and a 25-device per-account limit with eviction auditing.SecurityPerformance
    • Audit logs are hash-chained; the maintenance job verifies the chain and fails loudly on any tamper.Security
    • Independent kill switches for signup, email login, OAuth, and uploads — togglable without a deploy.Security
    • Refunds and disputes claw credits back through negative ledger entries; balances never go negative.Security
    • Recovery links bind to the requesting device and network; redemption from a different context is audited.Security

    added

    • Passkey (WebAuthn) enrollment with the same strength requirements as authenticator changes.NewInterface
    • Security alert sweep: login-failure velocity, MFA bursts, recovery abuse, role changes, and webhook-signature failures all alert operators.NewSecurity
    • Outbound request guard blocks SSRF against private ranges and metadata endpoints before any AI integration ships.New
    • Two-tenant adversarial browser suite and weekly ZAP scans against preview deployments.NewInterface
    • Security operations manual with rotation runbooks, incident response, and the external hardening checklist.NewSecurity
    • New guides: reporting vulnerabilities and recognizing phishing.NewSecurityInterface

    changed

    • Version advanced to 0.14.0 across every surface.Improved

21. v0.13.0

    Sep 6, 2026Changelog and documentation

    Update

    A public release timeline and a task-based documentation system — every update and guide now has a home.

    added

    • Public changelog page with filtering, live search, and per-release deep links.New
    • Semantic tags on every change: new, improved, bug fix, security, performance, breaking, removed, and interface.NewSecurityBreaking
    • Documentation system with task-based guides and structured use cases across five sections.NewInterface
    • Searchable docs sidebar, on-this-page outline, reading progress, and prev/next navigation.NewInterface
    • Changelog and Docs entries in the marketing navigation and footer.NewInterface

    changed

    • Application version advanced to 0.13.0 across every surface.Improved

22. v0.12.0

    Aug 15, 2026Platform-wide security hardening

    UpdateSecurity

    Concurrency-safe credits, stricter content security, and hardened webhook processing across the platform.

    security

    • Eliminated a credit race condition: concurrent overspend attempts can never both succeed.SecurityPerformance
    • Webhook signatures are now verified before any event lookup, preventing event-id probing.Security
    • Removed inline script allowance from the content security policy; every page now uses per-request nonces.Security
    • Stored webhook snapshots are PII-redacted and size-capped.Security

    added

    • Environment-customizable included credits per plan.New
    • Database-level guarantees that credit balances never go negative.New
    • Additional rate limiting on the OAuth callback and logout routes.NewSecurity

    changed

    • Webhook processing unified behind a single trusted plan catalog.Improved
    • Version displays synchronized across every surface.ImprovedInterface

23. v0.11.0

    Aug 12, 2026Subscriptions, credits, and billing

    UpdateSecurity

    Full subscription billing with plans, top-up packs, checkout, the customer portal, and a ledger-backed credit system.

    added

    • Subscription plans across monthly and yearly cycles with one-time credit top-ups.New
    • Customer portal for managing an active subscription.New
    • Idempotent, ledger-backed credit system tied to verified billing events.NewPerformance
    • Billing activity across checkout, subscription sync, and credit grants is auditable.NewSecurity

    security

    • Billing operations fail closed unless every required server-side flag is explicitly enabled.SecurityBreakingInterface
    • Webhooks verified with signed HMAC signatures and idempotent processing.SecurityPerformance
    • Credit spending is concurrency-safe and never produces a negative balance.Security

24. v0.10.0

    Aug 11, 2026Anti-abuse and account protection

    UpdateSecurity

    Tighter anti-abuse controls, privacy-first location handling, and two account-takeover fixes.

    fixed

    • Blocked a path where a password-recovery link could mint a password on a Google-only account.Bug fix
    • The sole organization owner can no longer demote themselves and orphan the organization.Bug fix

    changed

    • Login activity locations now come from deployment headers first, degrading privately to Unknown.ImprovedNew
    • Password reset on OAuth-only accounts routes to the password-setup flow instead.Improved

    removed

    • Removed the live third-party geolocation call from the login path.RemovedBreaking

    security

    • Mailbox aliases collapse into a single anti-abuse rate-limit bucket.Security
    • Reset attempts on OAuth-only accounts are blocked and audited without revealing provider state.Security

25. v0.9.1

    Aug 2, 2026Stability and verification hardening

    UpdateSecurity

    Faster fail-closed dashboards, cleaner sensitive links, and verified database connections.

    fixed

    • Fixed a redirect loop after emergency session containment.Bug fixSecurity
    • Legacy authentication URLs now redirect to clean canonical routes before rendering.Bug fix
    • Database outages on the dashboard fail closed with a retryable state instead of crashing.Bug fixBreakingInterface

    changed

    • Sensitive-link proofs carry an explicit version prefix for deterministic retirement.Improved
    • Database connections use bounded timeouts, keepalive, and verified TLS.ImprovedPerformance

    added

    • Centralized site copy and external design tokens for fast, safe brand maintenance.New

    security

    • Pre-versioned security-link proofs are rejected at both boundaries.Security
    • Remote PostgreSQL connections require certificate verification.SecurityInterface

26. v0.9.0

    Aug 2, 2026Secret-free authentication links

    UpdateSecurity

    Email links no longer carry secrets in URLs: tokens moved to short-lived cookies.

    security

    • Auth URLs no longer expose emails, user IDs, or tokens to logs, referrers, or browser history.SecurityBug fix
    • Sensitive links arrive as URL fragments, are scrubbed from history, and exchanged over POST.Security

    changed

    • Password reset delivery runs after the uniform public response, reducing timing differences.Improved
    • Used or expired security links guide the user to a fresh login.ImprovedSecurityInterface

    fixed

    • Removed email prefill values from recovery and verification URLs.Bug fix
    • Fixed the confusing dashboard bounce after emergency account containment.Bug fixInterface

27. v0.8.2

    Aug 2, 2026Development launcher recovery

    Update

    Local development servers recover automatically after interruptions.

    fixed

    • The dev launcher no longer mistakes an unrelated process for the app server.Bug fix
    • Stale lock records are removed automatically; active locks honor a fresh heartbeat.Bug fix

28. v0.8.1

    Aug 2, 2026Security review links

    Update

    New-device and MFA alerts now carry single-use, seven-day review links.

    added

    • Account-bound security-review tokens with explicit valid, expired, used, and wrong-account states.NewSecurity
    • A reported alert can trigger narrowly scoped emergency containment without a login.New
    • Provider-aware email change with confirmation from both addresses.New

    fixed

    • Security emails now link to a fresh token instead of a page that immediately invalidates it.Bug fixSecurity
    • Alert states distinguish exactly what happened without revealing another account.Bug fixInterface

29. v0.8.0

    Aug 2, 2026RLS-locked data boundary

    UpdateSecurity

    Row-level security now requires an active, non-revoked application session on every read.

    security

    • Browser roles lost write grants on every application table.Security
    • RLS and Storage writes require a current, non-revoked application session and active account.SecurityInterface
    • Live database tests simulate unauthorized and revoked sessions under RLS.Security

    added

    • Architecture security map, STRIDE threat model, prioritized roadmap, and security scorecard.NewSecurity
    • Current-tree and full-Git-history secret scanning.New

    changed

    • Login and signup bind Turnstile challenges to authentication with combined IP and account limits.Improved

30. v0.7.1

    Aug 1, 2026Private storage and encrypted email queue

    UpdateSecurity

    Storage buckets are private, security emails are encrypted at rest, and authorization fails closed.

    security

    • Both storage buckets made private; unsafe RLS write policies and grants removed.Security
    • Security email recipients and bodies encrypted at rest and erased after delivery.Security
    • Session authorization fails closed on missing session identifiers.SecurityBreaking

    added

    • Authenticated same-organization avatar and organization-asset delivery.New
    • Full-stack security and penetration-review report.NewSecurity

    fixed

    • Legal acceptance gates now use admin-controlled metadata instead of user-editable values.Bug fix

31. v0.7.0

    Aug 1, 2026Audit evidence and account lifecycle

    UpdateSecurity

    Immutable audit logs, a transactional email outbox, scheduled account deletion, and safe uploads.

    added

    • Tenant-aware RLS policies and immutable structured audit and legal evidence.NewSecurity
    • Decode-and-reencode image processing with metadata removal and distributed quotas.New
    • Two-address verified email changes and scheduled 30-day account deletion with a recovery window.New
    • URL-native nested settings sections with dedicated loading and error boundaries.NewInterface

    changed

    • Password policy follows modern passphrase guidance: at least 15 characters, no forced composition.ImprovedInterface
    • Transactional security emails persist before delivery and retry with bounded backoff.ImprovedSecurityPerformance

    security

    • Append-only database triggers protect audit and legal evidence.Security
    • Production startup rejects missing readiness and job-runner credentials.SecurityBreaking

32. v0.6.1

    Aug 1, 2026Audit-only documentation release

    UpdateSecurity

    Documentation corrected to stop overstating upload, RLS, and session-storage readiness.

    changed

    • Security, authentication, and database documentation aligned with the verified implementation.ImprovedSecurity

    security

    • Launch-blocking gaps documented without exposing, rotating, or printing any secret.Security

33. v0.6.0

    Aug 1, 2026Recovery, MFA codes, and security email

    Update

    Hashed single-use recovery, MFA recovery codes, and professional security email with encrypted IPs.

    added

    • Resend-delivered password recovery with hashed, single-use 30-minute tokens.New
    • Email-verified password creation for Google accounts.New
    • Ten hashed one-time MFA recovery codes with regeneration and recovery from the MFA screen.New
    • Encrypted-at-rest IP addresses in the active-session inventory.NewSecurity

    fixed

    • MFA verification no longer leaves the browser on a partial session level after cookie rotation.Bug fixSecurity

    changed

    • Security email redesigned responsively with dark-mode support and device context.ImprovedSecurityInterface

34. v0.5.2

    Aug 1, 2026Dev server cache protection

    Update

    Local development can no longer corrupt the route cache.

    fixed

    • Concurrent dev servers now take a project-level process lock instead of corrupting shared caches.Bug fixPerformance

35. v0.5.1

    Jul 31, 2026Security review page and enrollment fixes

    UpdateSecurity

    New-device emails gained a dedicated review page and account-lockdown flow.

    added

    • Authenticated security-activity review page with recognized/report decisions.NewSecurity
    • Guarded operator script for cleaning stale unverified MFA factors.New

    fixed

    • Unique enrollment names and abandoned-factor cleanup end MFA setup conflicts.Bug fix
    • Successful Google password setup reflects in the UI immediately.Bug fixInterface

    security

    • Security email links stay non-authoritative; activity IDs are ownership-checked.Security

36. v0.5.0

    Jul 31, 2026Sessions, devices, and account controls

    UpdateSecurity

    Device inventory, individual and bulk session revocation, and audited disable/delete workflows.

    added

    • Canonical user profiles, account status, and privacy-preserving session metadata.NewSecurity
    • Individual application session revocation and native bulk Supabase revocation.NewSecurity
    • Server-side branded welcome and unrecognized-device emails.New
    • Audited disable and delete workflows with typed confirmation and reauthentication.NewSecurity

    changed

    • Password setup, MFA enrollment, session revocation, and danger-zone actions require fresh authentication.ImprovedSecurityInterface

    security

    • Passwords remain exclusively managed and hashed by the auth provider.Security
    • HMAC device fingerprints and disabled-account enforcement added.SecurityNew

37. v0.4.11

    Jul 31, 2026Back to Vercel

    Update

    Standardized deployment on Vercel and removed the Cloudflare adapter.

    changed

    • Restored the native Next.js proxy session boundary for Vercel.ImprovedSecurity
    • Standardized deployment documentation on Vercel only.Improved

    removed

    • Removed OpenNext, Wrangler, managed Sites metadata, and Cloudflare build scripts.RemovedInterface

38. v0.4.10

    Jul 31, 2026Packaging compatibility

    Update

    Packaging supports combined production runtimes.

    fixed

    • Packaging handles runtimes containing multiple generated server copies.Bug fix

39. v0.4.9

    Jul 31, 2026Guarded loader rewrite

    UpdateSecurity

    Post-bundle rewrite for the generated instrumentation loader.

    added

    • Guarded post-bundle rewrite for the generated instrumentation loader.New

    security

    • The rewrite requires exactly one known signature and aborts packaging on upstream changes.SecurityInterface

40. v0.4.8

    Jul 31, 2026Instrumentation compatibility

    Update

    Excluded the incompatible generated launcher from the Worker artifact.

    fixed

    • Production requests no longer fail while loading Node-specific instrumentation.Bug fix

41. v0.4.7

    Jul 31, 2026Builtin module bridges

    Update

    Direct, wrapper-safe builtin module resolution inside generated wrappers.

    changed

    • Replaced the CommonJS bridge with direct builtin-module rewrites for static Node built-ins.ImprovedInterface

42. v0.4.6

    Jul 31, 2026Hosting-only launcher rewrite

    Update

    Replaced the generated launcher with a self-contained ESM monitor.

    added

    • Hosting-only rewrite preserving server-side error instrumentation without the CommonJS launcher.New

43. v0.4.5

    Jul 31, 2026Worker builtin bridge

    Update

    Minified handlers resolve Node builtins through the runtime bridge.

    fixed

    • Prevented the minified handler from failing at startup with a missing require reference.Bug fixInterface

44. v0.4.4

    Jul 31, 2026Artifact minification

    Update

    Server-function minification reduced the production artifact size.

    changed

    • Enabled server-function minification for the managed artifact.Improved

45. v0.4.3

    Jul 31, 2026Trace pruning

    Update

    Validated pruning of unreachable image-processing binaries before packaging.

    fixed

    • The image-optimizer trace no longer adds every platform-specific binary to the artifact.Bug fix

46. v0.4.2

    Jul 31, 2026Artifact size control

    Update

    Removed the unnecessary WebAssembly optimizer from the artifact.

    fixed

    • Removed the unused WebAssembly image optimizer to stay within the artifact size limit.Bug fixBreaking

47. v0.4.1

    Jul 31, 2026Session boundary on the edge

    Update

    Session refresh moved to the edge for adapter compatibility.

    changed

    • Session-refresh boundary switched from the Node proxy to edge middleware for adapter compatibility.ImprovedSecurity

48. v0.4.0

    Jul 31, 2026Authenticated navigation and bot protection

    UpdateSecurity

    Authenticated marketing navigation, provider-aware password setup, Turnstile, and disposable-email blocking.

    added

    • Authenticated marketing navigation with an accessible profile menu.NewInterface
    • Provider-aware password setup for Google-only users.New
    • Cloudflare Turnstile validation and a signup honeypot.New
    • Expanded dashboard command center with launch progress and quick actions.NewInterface

    changed

    • Session refresh expanded to all page requests while excluding APIs and static assets.ImprovedSecurity

    security

    • Fail-closed production CAPTCHA and server-only validation of disposable domains and Turnstile tokens.Security

49. v0.3.4

    Jul 30, 2026Version metadata patch

    Update

    Centralized application and package metadata advanced to 0.3.4.

    changed

    • Centralized metadata synchronized across the application and package files.Improved

50. v0.3.3

    Jul 30, 2026Repository governance

    UpdateSecurity

    CI, CODEOWNERS, Dependabot, secret scanning, and semantic versioning across the repository.

    added

    • GitHub workflow, required local pre-commit validation, CI, and Dependabot.NewInterface
    • Centralized product/version metadata, dashboard and footer version display, and a version endpoint.NewInterface
    • Owner-reviewed snapshot branch and approved pull-request flow.New

    security

    • Staged and repository-wide high-confidence secret scanning with conflict-marker detection.Security
    • Independent recovery-proof signing separated from the administrative key.Security

51. v0.3.2

    Jul 30, 2026Theme toggle stability

    Update

    Final theme-toggle hydration branch removed; switch thumbs anchored.

    fixed

    • Theme toggle renders stable icon markup, removing the hydration flicker.Bug fix
    • Switch thumbs use a smooth, bounded transform without overflow.Bug fix

52. v0.3.1

    Jul 29, 2026Runtime-neutral error reporting

    Update

    Replaced the heavy SDK with a runtime-neutral envelope reporter.

    changed

    • Sanitized browser, server, and edge error reporting retained with a smaller footprint.ImprovedPerformance

53. v0.3.0

    Jul 29, 2026Legal acceptance, consent, and MFA

    UpdateSecurity

    Versioned legal acceptance, a consent manager, recovery proofs, and TOTP MFA with AAL2 step-up.

    added

    • Versioned Terms and Privacy acceptance before workspace access.NewSecurity
    • Consent manager with necessary, functional, analytics, and marketing categories.New
    • Enumeration-resistant password recovery with short-lived signed proofs.New
    • Supabase TOTP MFA enrollment, AAL2 step-up challenges, and authenticator removal.New

    security

    • Optional trackers stay inactive before consent; recovery links cannot be reused as normal sessions.Security

54. v0.2.1

    Jul 29, 2026OAuth session persistence

    UpdateSecurity

    Fixed Google OAuth PKCE session persistence with response-bound cookies.

    fixed

    • Google OAuth sessions persist through response-bound cookies and edge-compatible refresh.Bug fixSecurity

    security

    • Server-side logout, same-origin checks, and non-cacheable authenticated responses.Security

55. v0.2.0

    Jul 28, 2026Dashboard and settings redesign

    Update

    Redesigned dashboard, complete tabbed settings, audited actions, and avatar upload.

    added

    • Redesigned dashboard with configurable tokens and theme-aware visualization.NewInterface
    • Complete tabbed settings for profile, security, notifications, appearance, and organization.NewSecurityInterface
    • Audited Server Actions, avatar validation/upload, and destructive-action confirmations.NewSecurity

56. v0.1.0

    Jul 28, 2026Initial foundation

    Update

    The configurable SaaS foundation: authentication, dashboard shell, schema, rate limiting, and the AI job contract.

    added

    • Configurable Next.js SaaS foundation.New
    • Supabase authentication, protected dashboard shell, and Drizzle schema.NewInterface
    • Security middleware, rate limiting, and a provider-neutral asynchronous AI job contract.NewSecurity

Security fixes ship as they are verified. Follow the standard channels for incident notifications.