WWebBuddyMarketplace
Sign in
Pages
Reference

Changelog

What changed in each LinkNest release, starting with 1.0.0, including the October 2026 security update.

3 min readUpdated Oct 17, 2026Applies to LinkNest 1.0.0

On this page

Demo mode (October 2026)

  • Read-only public demo: with DEMO_MODE=true, the sign-in dialog offers one-click creator and admin demos backed by a seeded sample page. Demo accounts cannot change anything, send broadcasts, start checkouts or call xAI. See Configuration.

Security update (October 2026)

Security fixes on top of 1.0.0; the version number is unchanged. Two new migrations, 0015 and 0016, run on the next start.

  • Admins: chosen by the new ADMIN_EMAILS variable. The first account is no longer made admin; existing admins are kept. Email addresses are not verified, so register listed addresses yourself. See Admins.
  • Plans: live_status, copilot, face_schedule, place_commerce, experiments, custom_domain and broadcasts are checked on the server, including on the public page and custom domains. Custom domains now follow the custom_domain key instead of any paid plan. Twenty keys are still not checked on the server; see Feature keys.
  • Plan keys: migration 0015 adds live_status, copilot, experiments, custom_domain and broadcasts to Pro and Premium, and faces, face_schedule, place and place_commerce to Premium. It only adds keys.
  • Rate limits: the subscribe field, the message form and password and email unlocks are limited per visitor IP and per page (migration 0016); the link shortener allows 30 new links per account per hour and only full http or https destinations, checked again on redirect.
  • Razorpay: charges USD by default. INR is charged only with the currency set to INR and an INR per 1 USD rate saved, converted at that rate.
  • Self-hosted redirect: pages other than / and /u/... no longer redirect to a placeholder Vercel host on your own domain, and the custom-domain CNAME target shows your host.
  • Payment secrets: stored encrypted with AES-256-GCM under the new SETTINGS_ENCRYPTION_KEY (or BETTER_AUTH_SECRET), and can be removed with Clear.

Important

Before updating: set ADMIN_EMAILS, and set SETTINGS_ENCRYPTION_KEY now rather than later. Saved payment secrets are encrypted on first read with whichever key is in use, and changing that key afterwards means entering them again. After updating: review Admin → Plans, because keys were added to Pro and Premium; set X-Real-IP at your proxy (Client IP for rate limits); and if you charge through Razorpay in INR, set the rate. If you had entered plan prices in rupees, change them back to dollars first.

1.0.0

Initial marketplace release, dated 25 August 2026 in the bundled help file.

Headline modules

  • Live status: an expiring status strip on the public page with five kinds (live, drop, open, playing, custom), a live countdown and an optional story link.
  • Faces and schedules: extra pages under one username, each with its own links, and weekday campaign schedules (personal, brand, event, tour) that switch the main address in a chosen timezone.
  • Place commerce: place mode with address, hours, Wi-Fi and menu link, daily specials with a tip button, and table QR stations with scan counts.
  • AI page co-pilot: a page plan (headline, bio, link order, links, a four-step week and notes) from xAI or a built-in planner, applied as a new bio and link placeholders, capped at 40 runs per page.

Platform

  • Public pages at /u/<username> with 18 themes, 9 typefaces, 6 button styles, background photo, socials, now pin, scheduled and locked links (age, email, password, tip), YouTube and Spotify embeds and A/B title tests.
  • Creator studio with Home, Links, Look, Share, Co-pilot, Earn, Place, Audience, Insights, Inbox and Settings, plus business cards, caption planner, keyword replies, link shortener and post ideas.
  • Earn: tips with a monthly goal, products, tip-to-unlock, payout requests with a $10 minimum.
  • Plan subscriptions through Stripe (with customer portal), PayPal and Razorpay, with signed or verified webhooks.
  • Free, Pro and Premium plans with editable feature keys.
  • Admin panel: Overview, Plans, People, Finance (payment ledger, estimated MRR, payout requests), Payment settings, Brand and Export.
  • Custom domains verified by a DNS TXT record.
  • Insights with traffic sources, places, devices, local hours and rule-based recommendations.
  • Email capture with CSV export and broadcasts through Resend.
  • Email and password sign-in with Better Auth.
  • Marketing site with /features, /pricing, /templates, /marketplace and /learn.
  • Postgres with 14 ordered migrations, or embedded PGLite for evaluation.
  • Builds for Vercel by default, or as a Node server through the included Dockerfile, which runs the migrations on start.

Version 1.0.0 also has known gaps, listed on Known limitations.