Changelog

Demo mode (October 2026)#

• Read-only public demo: with DEMO_MODE=true, the sign-in page offers one-click studio and admin demos backed by a seeded sample workspace. Demo accounts cannot change anything or trigger paid work. See Configuration.

Security update (October 2026)#

A security update to 1.0.0. The version number is unchanged.

• Billing. Without STRIPE_SECRET_KEY, production refuses simulated plan and top-up purchases unless ALLOW_SIMULATED_BILLING=true. Only workspace owners can buy plans or top-ups or open the billing portal.
• Sign-in redirects. callbackUrl, and the return address of share-link and template forms, only accept paths on your own site. Anything else goes to /dashboard.
• Admin access. ADMIN_EMAILS is authoritative: listed addresses are admins and cannot be revoked in the panel, and removing an address demotes that user unless their admin flag was granted under Admin → Users. See First admin.
• View as support now opens the workspace with the viewer role instead of the owner role. Some actions do not check the viewer role yet; see Known limitations.
• Suspended workspaces. Their API keys are refused with 401.
• Your own details. The privacy policy, Settings → Privacy and the suspended-workspace page show SUPPORT_EMAIL, PRIVACY_EMAIL and the site name from AUTH_URL, with example.com placeholders when unset. EMAIL_FROM falls back to Resend's test sender, so production must set it.
• Admin → Providers shows the bucket from R2_BUCKET, and the Resend note no longer says development sign-in depends on it.

1.0.0#

Initial release.

Product#

• Brand kits read from a website (logo, colours, fonts, tagline, tone and a screenshot) or edited by hand, kept as versions; several brands per workspace.
• Product library with upload or import from a product page, and automatic background removal.
• Briefs with AI help, and eight streamed ad concepts per run across seven persuasion angles, with copy kept within each platform's limits.
• Static ads in AI-designed or editable mode, four art directions, four sizes, a layer editor, refinement, PNG and ZIP downloads, saved layouts and bulk generation.
• Product videos built scene by scene and assembled with Remotion in three sizes.
• Presenter (UGC) videos with HeyGen presenters, ElevenLabs or HeyGen voices, B-roll, captions and an AI-generated label.
• Character Studio: generated faces, HeyGen photo and prompt avatars, digital twins with a consent link, ten look presets, a presenter library, and HeyGen voice cloning and design.
• Campaign builder for Meta, TikTok and Google Ads with placement checks and a claims review, published paused by default; sandbox accounts for all three.
• Performance view with period comparison, per-creative results, fatigue alerts, disapproved ads and CSV export.
• Teams with owner, editor and viewer roles; comments, approvals, client review links and templates; workspace audit log; a read-only API with signed webhooks.
• Credits with a ledger, three Stripe plans, a top-up and the customer portal; trial credits; plan feature switches; spending guardrails.
• Platform admin panel: overview, organisations, users, generations and costs, model catalogue with testing, providers, billing, campaigns, errors, settings and audit log.
• Magic-link and Google sign-in; the first admin is named in ADMIN_EMAILS.
• Runs on PostgreSQL, or an embedded database for evaluation; one Dockerfile that migrates on start; optional Inngest for retries and scheduled jobs; local disk or Cloudflare R2 storage; nightly backups with Inngest.

Security#

• Ad-platform tokens are encrypted at rest with AES-256-GCM.
• Stored files are served only to members of the workspace that owns them, with a sandboxing content security policy.
• API keys are stored as hashes; webhooks are signed with HMAC-SHA256.
• The development sign-in is never available in production, and the container drops root privileges before starting the app.

Version 1.0.0 also has known gaps, listed on Known limitations.