Changelog

198 entries across 23 release days · latest 11 October 2026

1. 11 October 2026

   1 change

   • Structured data scoped to marketing pages

     Marketing

2. 4 October 2026

   2 changes

   • Per-tenant custom domains, TLS provisioning code

     Marketing

   • Scheduled off-box drill with failure and staleness alerts

     Marketing

3. 3 October 2026

   4 changes

   • Gate pass bound to a live grant

     Marketing

   • Every payload type reveals through a gate

     Marketing

   • Pending team invitations with revoke

     Marketing

   • Dev mail sink for emailed links

     Marketing

4. 1 October 2026

   3 changes

   • Tenant-held-key (E2E) mode

     Core (QR + encryption)

   • Marketing site in German, `/de/*`

     Marketing

   • Hero A/B harness, cookieless

     Marketing

5. 29 September 2026

   1 change

   • Five tiers: Free for trying, Starter $4

     Marketing

6. 13 September 2026

   4 changes

   • Apple and Google Wallet pass SIGNING (kng6f, partial)

     Marketing

   • Seeded dev data you can actually dogfood

     Marketing

   • Local stack on a reserved static port band (18004-18019)

     Marketing

   • `.orb.local` is not a reachable address on this machine

     Marketing

7. 12 September 2026

   1 change

   • Multi-org membership: one person, many workspaces

     Dashboard / API

8. 11 September 2026

   8 changes

   • DEK rotation no longer destroys the payload history

     Marketing

   • Client-bundle NEXT_PUBLIC_* reach the browser

     Marketing

   • Migration 0001 stops hardcoding the database name

     Marketing

   • Production refuses the shipped qr_app password

     Marketing

   • BUILD_SHA finally has a producer

     Marketing

   • Scheduled Postgres backups exist at all

     Marketing

   • Index the five filtered FK columns

     Marketing

   • Local build context no longer ships the terraform provider

     Marketing

9. 10 September 2026

   10 changes

   • Client-IP resolution behind a trusted-proxy allowlist

     Dashboard / API

   • Build sha on every health response

     Dashboard / API

   • The agent reads content, on its own scope

     Dashboard / API

   • Exactly-once on the mutating MCP tools

     Dashboard / API

   • Tenant isolation asserted at the MCP layer

     Dashboard / API

   • The v1 archive path leaves an attributed record

     Dashboard / API

   • The CSRF refusal joins the v1 error contract

     Dashboard / API

   • The v1 access-link route enforces the plan quota

     Dashboard / API

   • D16 Guardrail 3 binds the agent principal, not the tool layer

     Dashboard / API

   • /subprocessors stops calling the model provider one of ours

     Marketing

10. 9 September 2026

    16 changes

    • Recipient verification page

      Dashboard / API

    • Sandbox delivery capture actually writes

      Dashboard / API

    • Route-mount gates compare identities, not counts

      Dashboard / API

    • Analytics and the consent banner are marketing-only

      Dashboard / API

    • Every credential class authenticates as the app role

      Dashboard / API

    • The ADR inventory is derived, not restated

      Dashboard / API

    • The qr_app privilege matrix is checked against the catalog

      Dashboard / API

    • The deployment doc's structural claims are checked

      Dashboard / API

    • Action approvals enforced on REST for machine principals

      Dashboard / API

    • Webhook delivery is pinned to an already-validated address

      Dashboard / API

    • Folder and per-QR grants ARE joined to key authority

      Dashboard / API

    • Adversarial scenarios in the deterministic agent eval

      Dashboard / API

    • Every drift gate fails under a controlled violation

      Dashboard / API

    • An OAuth access token is a working machine principal

      Dashboard / API

    • The scope is checked before a human approval is opened

      Dashboard / API

    • The MCP documentation URL the OAuth metadata advertises is served

      Dashboard / API

11. 8 September 2026

    11 changes

    • An unauthorized reputation provider no longer reads as an unreachable one

      Marketing

    • Isolated integration sandbox

      Marketing

    • Agent framework adapters generated from the spec

      Marketing

    • Delegated OAuth consent for hosted MCP clients

      Marketing

    • Agent behaviour evaluation, and the finding it produced

      Marketing

    • Metered agent operations and a predictable budget

      Marketing

    • An MCP agent can now write conditionally

      Marketing

    • The document an agent executes against

      Marketing

    • Local stdio MCP bridge, verified as a process

      Marketing

    • Agent positioning on the public site

      Marketing

    • Blog: MDX index, post template and RSS

      Marketing

12. 7 September 2026

    38 changes

    • Worker jobs run under RLS

      Dashboard / API

    • Route credential classes

      Dashboard / API

    • Action-level API-key scopes + agent label

      Dashboard / API

    • Tenant ceiling + write-action budget on API keys

      Dashboard / API

    • Action-bound human approvals

      Dashboard / API

    • Short-lived on-behalf-of tokens

      Dashboard / API

    • Tenant credential kill switch

      Dashboard / API

    • Queued work stops when its credential does

      Dashboard / API

    • Fix: `POST /api/v1/bulk` 500-ed for every caller

      Dashboard / API

    • Machine-principal audit trail

      Dashboard / API

    • Access delivered without a bearer secret

      Dashboard / API

    • One authorization decision for every surface

      Dashboard / API

    • Fix: v1 ignored folder grants entirely

      Dashboard / API

    • Safe retries and concurrent agent edits

      Dashboard / API

    • Agents create QRs from content handles, not plaintext

      Dashboard / API

    • One outbound destination policy, with DNS

      Dashboard / API

    • Fix: v1 error details echoed the request body back

      Dashboard / API

    • Fix: the webhook DNS re-check did not check DNS

      Dashboard / API

    • Fix: a replay could return a response the credential had lost the right to

      Dashboard / API

    • Remote MCP server over Streamable HTTP

      Dashboard / API

    • Whitelisted QR search with projection

      Dashboard / API

    • Per-credential velocity caps on delivery and payload reads

      Dashboard / API

    • Owner-set daily write cap per API key

      Dashboard / API

    • Agent administration console

      Dashboard / API

    • /api/v2 with nested errors and capability discovery

      Dashboard / API

    • Human-in-the-loop elicitation on gated MCP tools

      Dashboard / API

    • Self-describing, trust-labelled MCP tools

      Marketing

    • Bulk PIN never readable, at rest or on read (found in kfwvj)

      Marketing

    • MCP tools versioned like a public contract

      Marketing

    • Destination screening on the machine surface

      Marketing

    • Injection and disclosure threat model, path by path

      Marketing

    • MCP rate-limit test no longer depends on the wall clock

      Marketing

    • Read-only reporting tools and endpoints

      Marketing

    • SDKs hardened for agent loops

      Marketing

    • Provider-unreachable screening is visible, and CI is truthful about it (kc3qc follow-up)

      Marketing

    • CORRECTION to the row above: the provider was reachable all along

      Marketing

    • CI split into a service-free push lane and a manual heavy lane

      Marketing

    • Destructive-migration guard actually wired (documented since June, enforced by nothing)

      Marketing

13. 6 September 2026

    9 changes

    • Machine-stable v1 error codes

      Dashboard / API

    • Per-API-key rate limiting on v1

      Dashboard / API

    • Cursor pagination on GET /api/v1/qrs

      Dashboard / API

    • Crawler + agent access to the API contract

      Dashboard / API

    • OpenAPI enriched for LLM tool generation

      Dashboard / API

    • Paginated bulk-job list

      Marketing

    • /llms.txt, generated so it cannot rot

      Marketing

    • RFC 9727 api-catalog

      Marketing

    • Markdown twins of the marketing pages

      Marketing

14. 5 September 2026

    6 changes

    • Email-OTP gate, reachable

      Marketing

    • Password policy: length and breach, not composition

      Marketing

    • Deterministic test suite

      Marketing

    • Public changelog at /changelog

      Marketing

    • Role change reaches live sessions

      Marketing

    • Session cache is a cache, not the authority

      Marketing

15. 4 September 2026

    35 changes

    • Viewer-facing localisation, en + vi

      Core (QR + encryption)

    • Design templates, brand kit and enforcement

      Core (QR + encryption)

    • Viewer watermark and download control

      Core (QR + encryption)

    • Payload version history with rollback

      Core (QR + encryption)

    • Tenant retention + per-QR no-logging

      Core (QR + encryption)

    • Per-folder access control

      Core (QR + encryption)

    • A/B split + language routing

      Core (QR + encryption)

    • Opt-in marketing tags, consent-gated

      Core (QR + encryption)

    • Print readiness: PDF, label sheets, checker

      Core (QR + encryption)

    • Starter kits + onboarding checklist

      Core (QR + encryption)

    • OpenAPI contract served and drift-guarded

      Marketing

    • Idempotency-Key on v1 mutations

      Marketing

    • Generated TypeScript and Python SDKs

      Marketing

    • scripts/ is typechecked (unticketed)

      Marketing

    • Scan notifications: first scan, thresholds, weekly digest, anomalies

      Marketing

    • Email moved into packages/mailer

      Marketing

    • Printed-QR lifecycle: pause, restore, fallback, destination health

      Marketing

    • Destination health probe

      Marketing

    • Unique-scan counting, compare view and emailed reports

      Marketing

    • Per-QR viewer policy

      Marketing

    • Bulk actions on QR codes

      Marketing

    • Request access on a gated QR

      Marketing

    • Six more QR content types: sms, email, phone, text, geo, social

      Marketing

    • Free static QR generator (kdnj1, ADR D15)

      Marketing

    • Destination reputation checks and auto-suspend

      Marketing

    • Outbound webhooks with signed delivery and a replayable log

      Marketing

    • GS1 Digital Link for retail packaging

      Marketing

    • New-device and new-location sign-in notices

      Marketing

    • Operator console: abuse triage, tenant lookup, suspension

      Marketing

    • Job reliability and operational alerting

      Marketing

    • Restore drill: scripted, verified, and logged (kfmnb, partial)

      Marketing

    • Per-tenant custom domains, application half (kcqn9, partial)

      Marketing

    • Apple and Google Wallet passes, unsigned half (kng6f, partial)

      Marketing

    • Go-live surface check in CI (T54 groundwork)

      Marketing

    • Migration continuity report and column mapping (k2bf4, partial)

      Marketing

16. 3 September 2026

    6 changes

    • Billing sells through a Merchant of Record

      Marketing

    • Multi-factor authentication

      Marketing

    • Clickwrap consent

      Marketing

    • Bot challenge on auth endpoints

      Marketing

    • Polar Merchant-of-Record billing

      Marketing

    • Multi-factor authentication

      Marketing

17. 2 September 2026

    7 changes

    • Account self-service

      Marketing

    • Working CI

      Marketing

    • Security-header floor

      Marketing

    • Member removal keeps tenant data

      Marketing

    • Scan-quota logging pause is complete

      Marketing

    • Pricing: annual cycle, no phantom trial

      Marketing

    • Container stack builds (unticketed)

      Marketing

18. 1 September 2026

    24 changes

    • Password reset

      Core (QR + encryption)

    • QR design customization

      Core (QR + encryption)

    • Folders, labels, campaign metadata, scheduling

      Core (QR + encryption)

    • App-store QR preset

      Core (QR + encryption)

    • Readable QR slug /q/<slug>

      Core (QR + encryption)

    • Hosted pages: business, link list, menu

      Core (QR + encryption)

    • Audit trail

      Dashboard / API

    • Drizzle journal guard

      Dashboard / API

    • Audit log viewer + CSV export

      Dashboard / API

    • Auth-form compliance sweep

      Dashboard / API

    • Bulk CSV import

      Dashboard / API

    • Refund/cancellation policy page

      Marketing

    • Docs + first-run onboarding

      Marketing

    • E2E smoke script (T52, partial)

      Marketing

    • PIN hashing fix

      Marketing

    • Billing access control

      Marketing

    • Billing page

      Marketing

    • Production env hardening

      Marketing

    • Billing webhook idempotency

      Marketing

    • Plan-limit enforcement

      Marketing

    • Legal pages (kgav1, partial)

      Marketing

    • File payload storage

      Marketing

    • Team invitations

      Marketing

    • Recurring jobs

      Marketing

19. 3 July 2026

    6 changes

    • Content format negotiation (?format= json/raw/vcf/html)

      Core (QR + encryption)

    • Branded interstitial before public 302

      Core (QR + encryption)

    • Rule-based redirect routing (geo/device/time + UTM)

      Core (QR + encryption)

    • API key management UI (create show-once, list, revoke)

      Dashboard / API

    • /security trust page + vendor-assessment FAQ

      Marketing

    • CipherField hero (perf: off-screen pause, idle 30fps, cell cap)

      Marketing

20. 2 July 2026

    1 change

    • SSRF guard on redirect destinations

      Core (QR + encryption)

21. 1 July 2026

    1 change

    • Public API v1 (Bearer API keys, scoped)

      Dashboard / API

22. 30 June 2026

    3 changes

    • Access gates: login, magic link, PIN, email OTP

      Core (QR + encryption)

    • Public mode (opt-in gate bypass, dynamic 302)

      Core (QR + encryption)

    • Tenant analytics overview + export

      Dashboard / API

23. 29 June 2026

    1 change

    • Envelope encryption (KMS -> tenant DEK -> per-QR payload)

      Core (QR + encryption)