A public record of what changed

Rebuilt the public landing page around the Shorten URL workflow and the product’s Bot Shield positioning.

• Added the Shorten URL form, core capabilities, Bot Shield showcase and analytics preview.
• Added use cases, pricing teaser and a final conversion CTA while keeping the light URL BOT visual system.
• Verified the landing marker in served HTML after deployment.

Kept the Changelog and System status routes reachable while removing both links from the visible footer navigation.

• Preserved the routes and sitemap coverage for direct access and verification.
• Placed both links in a shared hidden list with hidden and aria-hidden attributes.
• Verified the hidden list in the served footer across public pages.

Added the comparison surface for visitors evaluating URL BOT against established link platforms.

• Published comparison pages for Bitly, Rebrandly, TinyURL, Dub, Short.io and Cuttly.
• Aligned the shared marketing footer and verified its comparison marker in the running application.

Refined typography, spacing and responsive behavior across the signed-in application shell.

• Applied the Inter-based light UI system consistently across app surfaces.
• Verified the typography build marker in CSS and the application body attribute.

Made the public navigation structure more consistent while grouping the free tools in a dedicated menu.

• Standardized the public navbar across marketing pages.
• Added the Tools dropdown without introducing a new frontend dependency.

Prevented public short-link aliases from colliding with application routes and reserved paths.

• Centralized reserved-alias handling through the existing URL validation utility.
• Kept the wildcard short-link route below reserved application routes.

Hardened outbound webhook delivery against server-side request forgery through private or unsafe destinations.

• Added destination validation before webhook delivery.
• Preserved HMAC signing, retries and the existing webhook workflow while blocking unsafe targets.

Fixed team switching and deletion behavior so account context remains consistent across team operations.

• Verified the team-switch build marker in the running application.
• Kept team-scoped link and membership operations aligned with the active team.

Added an on-screen QR preview and share surface after QR generation.

• Made generated QR codes easier to inspect before download or sharing.
• Added share actions while retaining the existing QR generation flow.

Synchronized the public pricing presentation with the current environment-backed plan configuration.

• Kept Free, Pro and Business plan messaging aligned across the marketing surface.
• Verified the pricing marker in the rendered page.

Improved real client-IP resolution behind the trusted proxy chain.

• Distinguished the actual visitor address from the local reverse-proxy hop.
• Kept proxy trust boundaries explicit for abuse controls and analytics.

Added origin verification for custom-domain traffic without weakening the trusted-proxy path.

• Protected the custom-domain origin path with an explicit verification marker.
• Preserved normal public short-link resolution and custom-domain routing.

Connected custom domains to short-link resolution and dashboard management.

• Added the custom-domain link workflow and its running build marker.
• Kept domain identity attached to the resolution and cache path.

Completed the live billing lifecycle around the Paddle portal and dunning states.

• Added the server-to-server billing checks required for portal access.
• Handled subscription grace and dunning outcomes without changing plan state outside the billing webhook flow.

Added the public post-checkout confirmation surface for successful Paddle purchases.

• Added a dedicated success page with a verifiable billing marker.
• Kept the confirmation route public and separate from the authenticated dashboard.

Introduced the live Paddle Billing v2 checkout and webhook foundation.

• Added the hosted checkout flow and subscription webhook handling.
• Kept billing plan changes webhook-driven rather than client-controlled.

Published the refund and cancellation policy required for the billing surface.

• Added a public policy page and its response marker.
• Linked the policy into the public legal and billing experience.

Promoted account email uniqueness into a database-backed constraint.

• Added the users.email unique-index migration with a safe existing-index check.
• Logged migration outcomes without exposing account data.

Restricted analytics breakdowns to the supported and privacy-reviewed dimensions.

• Added an explicit allowlist for analytics breakdown parameters.
• Emitted a running-build marker so the deployed behavior can be verified.

Hardened the content security policy for the public and authenticated surfaces.

• Applied nonces to inline scripts where required by the policy.
• Kept styles compatible with the single self-hosted stylesheet architecture.

Moved backup handling to the intended server-side location and kept operational artifacts outside the application surface.

• Reduced the chance of backup files being mixed into the deployed application tree.
• Preserved the existing rollback and archive workflow.

Completed the one-click email-verification confirmation path.

• Added the confirmation handler and verifiable response marker.
• Kept verification state changes tied to the signed token flow.

Added domain-cluster signals to help identify coordinated signup abuse.

• Recorded the signal for moderation and abuse review rather than exposing it publicly.
• Kept the existing signup response surface privacy-safe.

Added a hidden honeypot to the public registration form as an additional low-friction abuse signal.

• Rejected automated submissions that filled the honeypot field.
• Kept the protection compatible with the normal registration path.

Changed active-account reporting to count only email-verified accounts.

• Prevented unverified signups from inflating active-user metrics.
• Propagated the verified-active marker through monitoring and account surfaces.

Added disposable-email blocking and deliverability validation to public signup.

• Rejected known throwaway domains.
• Used MX and deliverability checks before sending verification mail.

Added per-client limits for registration and verification-email bursts.

• Capped abusive signup and resend bursts by trusted client IP.
• Kept the limiter separate from the existing application rate limits.

Added Cloudflare Turnstile verification to the public signup flow.

• Verified the challenge server-side before creating an account.
• Kept the failure path safe for unauthenticated visitors.

Added the standard security contact surface for responsible vulnerability reporting.

• Published a security.txt response with the current public contact details.
• Added a verifiable security build marker to the response.

Added the public OpenAPI reference for URL BOT’s REST integration surface.

• Published the machine-readable API description and browser-readable documentation.
• Added a response marker so the running documentation can be distinguished from an older build.

Opened a permanent, indexable record of URL BOT product development for customers, developers and external reviewers.

• Added this public release history, a sitemap entry and a footer link across public pages.
• Added a verifiable response marker so the running release can be distinguished from an older binary.
• Linked the record to the live API documentation and public project documentation.

Replaced a local breakpoint workaround with generated responsive utilities while preserving the mobile and desktop navigation behavior already in production.

• A breakpoint regression was caught during verification, rolled back, corrected and re-verified before closure.
• Navigation remained reachable across mobile, tablet and desktop widths.
• The shared stylesheet and every affected public reference were reconciled as one release.

Improved small-screen reachability across public, account and administrator surfaces, then added scheduled moderation-review rescans with a durable audit trail.

• Added keyboard-aware mobile navigation with escape-to-close and focus restoration.
• Contained wide tables inside scrollable regions instead of widening or clipping the page.
• Added bounded, cleanly shutting-down review rescans distinguishable from operator-triggered scans.

Added a public contact page with authenticated SMTP delivery and protections appropriate for an unauthenticated form.

• Added CSRF validation, a honeypot and Bot Shield protection on submissions.
• Added the page to public navigation and the sitemap.
• Verified the complete browser-to-mailbox delivery path.

Aligned API tag behavior, simplified the visual system and rebuilt shared styling from the project configuration before refining narrow-screen headers.

• Empty tag collections now serialize consistently rather than appearing as null values.
• Removed an unused theme system and rebuilt the stylesheet from generated utilities.
• Improved logged-in and logged-out header behavior at responsive breakpoints.

Expanded the public and developer surfaces while adding link-state and review workflows for administrators.

• Opened QR codes to the Free plan without weakening separate plan capabilities.
• Added API tag updates, a plans endpoint and the public REST API reference.
• Added active, disabled and flagged link states plus an administrator review queue and audit history.

Updated the visual assets served by the application and consolidated brand marks across public, social and transactional-email surfaces.

• Refreshed favicon, social preview and email assets.
• Standardized horizontal and compact logo placements across public views.
• Versioned shared asset references where browser and edge caches required it.

Moved administrator management into explicit database-backed workflows and completed the account-email lifecycle.

• Added scoped administrator commands for account creation, password reset and email management.
• Completed email verification and password-reset delivery through authenticated SMTP.
• Expanded append-only audit coverage for key account and administrative actions.

Established the operational foundations for protected redirects, measurable traffic and a coherent public product surface.

• Improved trusted-proxy handling and operator controls for Bot Shield.
• Added API v1 rate limiting, keyset pagination and bulk link creation.
• Added timestamped HMAC webhooks with retries, period comparison and Redis-backed analytics rollups.
• Consolidated shared views and aligned public pages with the URL BOT visual system.