What's new
Every release, including the bugs we shipped and then fixed.
Real accounts, real billing, real admin
- NewAuthentication is now server-side and backed by Postgres. Passwords are hashed with scrypt at OWASP-aligned parameters with a per-user salt and a server-side pepper; sessions are opaque rotating tokens stored as HMAC digests, not JWTs. The previous build kept accounts in browser localStorage, which meant anyone could edit their own plan.
- NewTwo-factor authentication with TOTP and single-use recovery codes. The shared secret is encrypted at rest with AES-256-GCM, and enrolment renders a real QR code.
- NewSign in with Google, which hides itself automatically when the OAuth credentials are not configured.
- NewPaddle billing as merchant of record: checkout, webhooks, plan changes, and cancellation that takes effect at the end of the period you have paid for rather than immediately.
- NewThe admin panel now reads and writes the real database — users, revenue, audit log and system settings — instead of per-browser localStorage.
- NewOperator kill switches for the API, batch processing, registration and Google sign-in, so a subsystem can be turned off during an incident without a deploy.
- NewPublic developer documentation at /docs, with ten-language code samples, and an API playground that sends a real request from your browser.
- NewAn audit log of security and billing events, surfaced in both the workspace and the admin panel.
- FixedThe admin SEO manager published nothing. It wrote overrides to the administrator's own localStorage while the marketing pages exported static metadata that never consulted them, so "Save & publish" changed the title in exactly one browser and crawlers always saw the compiled-in copy. Overrides now live in the database and are resolved on the server while each page's metadata is generated.
- NewTen landing pages are editable from the SEO manager, including the Gemini, Veo and C2PA scrubber pages, which previously had no managed metadata at all. Saving purges the cached copy of every page, so an edit is live in seconds rather than at the next deploy.
- FixedAdded a social share image. Every page declared a summary_large_image Twitter card with no image behind it, so every shared link rendered as a blank card.
- FixedCorrected the security page, which described controls this application does not have: it advertised bcrypt (the code uses scrypt), RS256 JWTs (there are none — sessions are opaque tokens), SameSite=Strict cookies (they are Lax) and Cloudflare DDoS mitigation (there is no Cloudflare). It now describes what is actually implemented, including the nonce-based Content-Security-Policy that was already in place and under-described.
- FixedRemoved fabricated compliance badges. The security page displayed "SOC 2 Type II — In Progress", "ISO 27001 — Planned" and "GDPR Compliant — EU Data Residency" as status indicators; no audit has been commissioned and the database runs in AWS us-east-2, so the residency claim was the reverse of true.
- FixedThe privacy policy, terms, DPA and cookie policy named Stripe as the payment processor. Billing runs through Paddle as merchant of record.
- FixedThe privacy policy and security page claimed files are never transmitted to our servers, without qualification. That is true of the Studio, Batch Scrubber and extension, but not of the Agency REST API, which receives the file by design. The exception is now stated wherever the claim appears.
- FixedDropped the WebAssembly claim from the marketing, pricing, privacy and security pages. There is no WebAssembly in the product — the engines are JavaScript.
- FixedRemoved invented social proof: "48,000+ files purified", "1,200+ active users", a five-star rating nobody had given, and three testimonials attributed to people who do not exist. This is the same class of claim as the fabricated aggregateRating removed in 1.0.1.
- FixedThe privacy policy claimed we run "minimal, privacy-preserving analytics". There is no analytics script of any kind, so the policy was over-stating what we collect.
- FixedCorrected the stated session lifetime in the privacy policy from 30 days to the real 12-hour idle and 14-day absolute expiry.
- FixedThe home page still advertised Runway Gen-3 while the Runway landing page had moved to Gen-4 and Aleph.
- NewThe web Studio and Batch Scrubber now run the byte-level metadata engine. Exports are genuinely stripped of C2PA, EXIF, IPTC and PNG text chunks rather than relying on a canvas re-encode.
- NewAdded "Export scrubbed original", which rewrites the source bytes so pixels stay identical and there is no re-encode.
- NewThe watermark mask can now be dragged and resized directly on the canvas, not just via sliders.
- NewDrag-and-drop upload across the Studio, Batch Scrubber and every landing page demo.
- ImprovedICC colour profiles are now preserved. In JPEG this required checking the APP2 payload identifier, since ICC profiles and C2PA manifests share that marker.
- ImprovedDetected metadata is listed with sizes and readable previews before anything is removed.
- FixedVideo export no longer writes PNG data into a file named .mp4. It now exports the current frame as a PNG and says so.
- FixedObject URLs are released after use — previously every upload leaked the full file into memory.
- SecurityThe admin panel rendered for anyone who typed the URL. The session is now verified server-side and the admin role is required; non-admins get a 404 rather than a 403, which would confirm the panel exists.
- ImprovedUpgraded to Next.js 16 and cleared every outstanding dependency advisory.
- ImprovedFonts are self-hosted, so a deploy no longer depends on Google's CDN being reachable from the build container.
Design system and responsiveness
- FixedGlass panels rendered with no styling at all because the stylesheet used a Sass @extend directive in a plain CSS file. Every card across the app was affected.
- FixedLight theme was unusable: a compatibility block redefined card and border tokens with dark values after the light theme block, so it always won.
- FixedThe mobile "Start Free" button had no background — its gradient referenced a CSS variable that was never defined.
- ImprovedFull responsive scale added at 1024, 900, 768, 560 and 400px. Verified zero horizontal overflow across every page from 360px to 1600px.
- ImprovedData tables now scroll inside their own container instead of dragging the whole page sideways on mobile.
- ImprovedAdded prefers-reduced-motion support and a skip-to-content link.
Workspace and admin routes
- NewBuilt out the full workspace: Overview, Studio, Batch, History, API Keys, Billing and Settings.
- NewBuilt out the admin portal: Users, Revenue, SEO Manager, Feature Flags, API Management and System Settings.
- FixedTwelve of fourteen sidebar links pointed at routes that did not exist and returned 404.
- FixedAdded the missing /terms, /auth/forgot-password and /c2pa-metadata-scrubber pages, all of which were linked from elsewhere in the site.
- ImprovedThe admin user search is now wired up, and pricing edits in the admin panel drive the public pricing page.
SEO and crawling
- Improvedrobots.txt and sitemap.xml are now generated from the route tree, so they cannot drift out of sync.
- FixedThe sitemap listed /c2pa-metadata-scrubber, which was a 404 at the time.
- SecurityRemoved a fabricated aggregateRating from the structured data. Review markup must reflect ratings actually collected and shown, and invented ratings risk a manual action.
First public release
- NewStudio canvas with watermark masking and three reconstruction modes.
- NewChrome extension (Manifest V3) with hover inspection, popup scrubber and C2PA side panel.
- NewDedicated tool pages for Runway, Sora, Midjourney and DALL-E.
Found something broken? Tell us and it will show up here.