Product

Changelog

Customer-facing notes, newest first.

Customer-facing notes, newest first. Internal refactor noise stays out.

2026-08-05

Security hardening — Captured response bodies encrypted at rest; session cookies can be revoked on logout; logout is a POST; dashboard writes check Origin/Referer; HTTP security headers (CSP, frame denial, nosniff); request header values masked in Events/Runs with a reveal toggle; CSV exports escape formula-leading cells.
Soft-launch ops — Production config refuses placeholder secrets; magic links never render in the browser when email will deliver.

Landing trust — Honest platform metrics (with a free soft-launch fallback), live schedule translator on the homepage, public Changelog / Status / About / Contact / Terms / Privacy / Roadmap pages, and keyboard shortcuts (n, / filter, j/k, Enter, p) that match what we advertise.
Honest paid-plan CTAs — Pricing cards route paid interest through Start free and remember the intended plan for later; signup stays Free-only until billing ships.
Dashboard polish — Sidebar logo links home, empty monitors copy distinguishes “none yet” from “no matches,” and monitor rows are real links (middle-click / open in new tab).

Stats aggregation v3 — Dashboard charts and counts read from hourly/daily aggregates with histogram-backed latency. Events feed uses short windows (15m / 1h / 3h / 24h) with a hard cap. Free and Starter Runs tabs clamp to each plan’s history limit.
Webhook delivery harness — Dogfood target for success, failure, DNS, and TLS edge cases (sibling project).

Prelaunch hardening — Plan caps at create/edit, auto-pause on sustained failure, Free-tier dormancy warn-then-pause.
Members & signup — Organizations, invites, tenant switcher, PLAN_CATALOG-driven pricing cards, dedicated /signup flow.

Initial public surface — Monitors, executions, alerts channels, magic-link auth, and the dual-scheduler + worker core.