Changelog

What we shipped, newest first.

Every entry here maps to work in the repository — released features, fixed bugs, and applied migrations. Nothing is listed before it ships.

  1. Security

    Security audit closed out

    • Secret API keys are no longer readable by viewer-role team members.
    • Discount redemption moved to an atomic Postgres update, closing a race that could allow unlimited redemptions.
    • Webhook and redirect URLs are validated against private, loopback, and link-local ranges to block SSRF.
    • Migration 0009 applies the database-side fixes.
  2. Platform

    QA pass across every page and API route

    • Checkout API now accepts the pk_ publishable key format issued by the signup trigger.
    • Creating an additional business no longer trips the merchants row-level security policy.
    • Product checkout keeps the product name through to the receipt.
    • Migration 0006 carries the fixes.
  3. Payments

    Settle, and a much larger operating surface

    • Renamed the product to Settle and rebuilt the marketing site and legal documentation.
    • Added an unmatched-transfers inbox and manual mark-as-paid for reconciliation edge cases.
    • Webhook delivery gained retries and a documented event catalog.
    • Added CSV export, payment-link analytics, subscription cancellation, and Google and GitHub sign-in.
  4. Networks

    Multi-chain settlement and dispute threads

    • Extended settlement beyond Base to Ethereum, Polygon, Arbitrum, Optimism, and BNB Chain.
    • Added emailed receipts backed by the on-chain transaction.
    • Added a dispute message thread between merchant and customer.
  5. Foundation

    Hosted checkout and the merchant dashboard

    • Hosted checkout pages, shareable payment links, and incognito checkout.
    • The merchant dashboard, analytics, invoices, and onboarding.
    • Non-custodial settlement on Base using unique-amount reconciliation.

Following along

Breaking API changes are announced before they take effect and are documented in the developer documentation. Current platform health is on the status page.