Changelog

What we're building and shipping.

Pre-launch · wave 28

2026-04-26
  • NEWTerms of Service and Privacy Policy shipped with full GDPR Art. 13 + CCPA disclosures and a complete sub-processor table
  • NEWGDPR self-serve: data export (Art. 20) and account deletion (Art. 17) wired into Settings
  • NEWStripe self-cancel via Customer Portal — required by Stripe ToS, EU "easy cancellation," and CA SB-313
  • NEWTransactional email via Resend: welcome, trial-ending T-2 days, payment-failed
  • NEWTrial-reminder cron at 09:00 UTC daily with idempotent send tracking
  • IMPROVEDBranded 404 / error / loading pages and a shared empty-state component
  • IMPROVEDAI-driven onboarding audit (gpt-4o-mini, structured JSON output) replaces the canned template every user used to receive
  • IMPROVEDPublic-by-default middleware so marketing and legal pages stop redirecting unauth visitors to sign-in
  • IMPROVEDCI now runs Playwright e2e against a pgvector Postgres service alongside the existing lint + typecheck + Vitest jobs

Pre-launch · wave 5 — security audit

2026-04-25
  • IMPROVEDTelegram webhook now verifies `X-Telegram-Bot-Api-Secret-Token`; fails closed in production
  • IMPROVEDSSRF protection on link-metadata fetcher: hostname blocklist plus manual one-hop redirect revalidation
  • IMPROVEDCORS allow-list for the Chrome extension (chrome-extension://, moz-extension://, linkedin/twitter/x.com)
  • NEWSECURITY.md published with threat model, controls table, and vulnerability-reporting flow

Pre-launch · wave 4 — production-readiness

2026-04-24
  • NEWApify cost guard: niche-shared cache (30-min TTL) + canonical 10-niche resolver, hitting the $0.03–0.10/user/day target
  • NEWEdge-level rate limits per route (generate, daily-juice, drafts, etc.) with 15-min abuse cooldown
  • NEW`/api/health` now pings Postgres, verifies pgvector, and validates required envs — returns 503 on any failure
  • NEWGitHub Actions CI: lint + typecheck + Prisma validate + Next build with a real pgvector Postgres service

Pre-launch · waves 1–3 — core surface live

2026-04-23
  • NEWStreaming `/api/generate/stream` wired end-to-end: Clerk auth → trial gate → hybrid retrieval → anti-slop dictionary → Bulb 2nd-pass virality scoring → save Draft
  • NEWHybrid retrieval (pgvector semantic + structured filters + recency boost) powers every generation
  • NEWChrome Extension v1 saves clips via signed extension tokens; bulk-select in feeds
  • NEWDaily Juice agent: Perplexity trends → OpenAI render → per-niche cache; cron refresh every 6h
  • NEWRejection-learning loop: dismissed drafts feed back into avoidedPhrases on the user's voice profile