Changelog

When we leave alpha

Beta: guest → account → scan → report does not lie; pay, renew, and cancel; account deletion; it/en/ja; trust is not a verdict. Stable (1.0): lawyer-reviewed terms, the same compile ≠ attack fence, continuity we can actually promise. We do not raise the channel because of commit volume, or because Pro is paid.

0.4.3 · alpha · 2026-10-25

An instrument other tools can hold

• Icons, share card, and titles and descriptions per language. A visitor with no preference, Google included, gets English. An Italian or Japanese browser stays in that language.
• /llms.txt and markdown for method, plans, manifesto, and the product card: an agent can read the fence without the HTML.
• A machine compile on /api/v1, with a personal key: the full plan, a profile, or a check list. Hybrid on Base; Deep on Pro, queued. The same contract is an MCP server. A /r/{token} link is not a feed.

0.4.2 · alpha · 2026-10-24

When something goes wrong

• When a scan, deep scan, monitoring, billing, or a password change fails, the message says what to do next, not what broke inside the server. A crash shows a nyaack error page, not a stack.
• Sign-in, sign-up, password reset, and confirmation resend are limited on the server, per network and, for mail, per address. A blocked attempt asks you to wait and does not say whether the account exists.
• Session cookies cannot be read by page scripts and travel only over HTTPS. A missing page is a nyaack 404; the sitemap drops auth pages that only make sense mid-flow.
• Pages refuse to be framed by other sites and do not let the browser guess content types. One pnpm lockfile, no known advisories in production dependencies at release, Next.js on 16.4.3.

0.4.1 · alpha · 2026-10-23

The compile face, without noise

• The face puts the verdict and the lowest area on one row: the number fills an invisible box, the other areas stay dials, and the bar only marks the floor.
• When a scan finishes, mode, coverage, and Completata share one row; HYBRID or DEEP follow the button you pressed, not an inference from coverage.
• In the sidebar the version sits below Docs, above the user chip. The dossier subject mark is narrower and centered; “How we measure” stays off phones.

0.4.0 · alpha · 2026-10-22

Facts on the subject, without a seal

• The compile reads the TLS chain and certificate key, the DNSSEC chain, A records from a second resolver, and payment cues on the document already fetched.
• The dossier shows areas (the number is the lowest), one row per check, and a residue mark on a watched subject. A mark does not move the number.
• “The chain reaches an anchor” only if the socket authorized the chain, or the error is expiry or a name mismatch. An ambiguous checkout does not vote. An area with no confirmed risk does not say safe. A vantage mismatch says the two resolvers returned different A records.
• Reading and writing a mark are rate limited. If the deep queue is off, a signed-in response does not name environment variables.

0.3.9 · alpha · 2026-09-23

Feedback arrives by mail

• Feedback sent from the app goes out through Proton SMTP and lands at feedback@nyaack.app. The form says received only after Proton accepts the message.
• It needs the mailbox SMTP token, not the password. Without the token the send fails in the open, instead of promising a delivery that never happens.

0.3.8 · alpha · 2026-09-21

Alerts: a private feed instead of destinations

• Read alerts outside nyaack through a private feed (Atom or JSON). In Slack it is just /feed subscribe. The URL shows once, and you can regenerate or turn it off.
• Email and the Slack field are gone from destinations: the mail never left, and the webhook sent JSON that Slack rejects. Better nothing than a silent promise.
• The feed carries the same sentence as the inbox, never the raw payload. No outbound calls to a URL you typed, so no internal address is reachable.

0.3.7 · alpha · 2026-09-21

Work lists: per-section filters and cleaner cards

• Every list filters on what it carries: type and gravity in Alerts, type and mode in Activity, period in Reports, state in Watch. Search has a lens and a clear button.
• Watch: one full-width row per host that opens on its logs. Circles share one size and the same right margin.
• Scan later is a card: fill the search, copy or drop a host, with a toast to confirm.
• Plans: CTAs aligned at the bottom, an Alpha tag, and copy about what you get. Alert destinations are described in words, not endpoints.

0.3.6 · alpha · 2026-09-16

Plans: Base and Pro

• /plans: Base and Pro. Guest sidebar; signed-in chip (Upgrade to Pro on Base, Plans on Pro). Billing opens the Stripe portal when a customer exists.
• No in-app gift code. A discount is a Stripe Checkout promotion code. Invite Pro returns to Base.
• invoice.paid / payment_failed sync the subscription. Past due stays Pro and is visible.

0.3.5 · alpha · 2026-09-15

Email confirm: expired link and honest resend

• /verify-email shows a banner when the mail link was already used or has expired.
• Send again does not fake success if the address is already confirmed (sign in) or if sending failed.

0.3.4 · alpha · 2026-09-15

Account: export and deletion

• From Settings: JSON of your data, and account deletion (scans, shares, avatar). An active Stripe subscription is cancelled.
• Cancel at period end: Pro stays until that date, then the plan returns to free. Scan cache is no longer a dossier shared across accounts.

0.3.3 · alpha · 2026-09-15

Manifesto and coverage

• Public /manifesto: identity document (vision, fence, refusal); compile ≠ name ≠ attack.
• /method is the lab sheet: subject, outcomes, modes, layers, reason codes, fence.

0.3.2 · alpha · 2026-09-14

Confirm email from any device

• Confirm email is a button on nyaack; opening the mail on a phone no longer depends on the PC session.
• After signup, or if the link is dead, /verify-email is the waiting room (resend, no dashboard).
• Login keeps the fields on error and does not say whether the email exists.
• Auth mail: English subject, brand HTML to paste from the repo; the body follows the account locale.

0.3.1 · alpha · 2026-09-14

Logs: activity, alerts, reports

• Three logs: /activity (diary), /alerts (facts), /reports (daily briefing). /monitoring stays the inventory.
• Cron watch is Pro only: pulse (DNS, cert, hash) then hybrid digest. The €0 plan is not in the tick.
• Pro alpha is €8/month tax inclusive; the live Stripe price matches the copy.

0.3.0 · alpha · 2026-09-13

Paid Pro and terms

• Pro subscription via Stripe Checkout (Managed Payments), plan webhook, cancellation portal.
• Terms and conditions and privacy policy: as-is baseline, compile ≠ attack, Stripe/Link as merchant of record.
• Public changelog: product cuts, not the git log.
• Vercel Web Analytics on page views.

0.2.0 · alpha · 2026-09-12

Horizon: compiled, named, not done

• The report shows the edge: what was compiled, what was only named, what this scan did not do.
• Around tab: star and dots, click to compile, no crawl and no automatic fan-out.
• Copy and scan limits stay on the active locale.

0.1.0 · alpha · 2026-09-07

App live

• Public scanner: one HTTP subject, portrait, tabbed report.
• Accounts, Deep on a worker, opt-in monitoring, share on request.
• Public channel: alpha. 0.x version: the product can still move.