Changelog

Security update (October 2026)#

Fixes on top of 0.1.0. The version number is unchanged.

Fixed#

• The Stripe webhook verifies every event against STRIPE_WEBHOOK_SECRET, in every environment. Without the secret it answers 503; unsigned or wrongly signed events get 400. Before, it accepted unsigned events when STRIPE_SECRET_KEY was not set.
• invoice.paid keeps the plan the workspace pays for, so Accountant workspaces no longer fall back to Pro on each renewal.
• Accountant mode is turned on only by a paid Accountant plan. The sign-up checkbox and the account API no longer grant it.
• Client workspaces follow the accountant's plan: they have paid features only while the accountant's workspace is on Accountant, and adding a client needs an active Accountant plan.
• The demo login is off in production unless DEMO_LOGIN_ENABLED=true, and while it is off the published demo password no longer signs in.
• Production without SMTP or Resend refuses email sign-up and magic links, instead of skipping verification and writing sign-in links to the log. ALLOW_UNVERIFIED_SIGNUP=true re-opens sign-up only.
• The Salt Edge and Setu return pages need a stored, single-use state and a signed-in Owner or Editor of that workspace. Salt Edge now stores the connection ID instead of the customer ID; this has not been tested against a live Salt Edge account.

Before you update#

• If you use Stripe, make sure STRIPE_WEBHOOK_SECRET is set, or plans stop changing after checkout.
• If you run a public showroom, set DEMO_LOGIN_ENABLED=true to keep the demo shop.
• If production has no outbound email, configure it, or set ALLOW_UNVERIFIED_SIGNUP=true to keep accepting sign-ups.
• Existing accountant accounts keep accountant mode, but their client workspaces are treated as Free until the accountant's own workspace is on the Accountant plan.

See Known limitations for what still applies.

0.1.0#

Initial release.

Product#

• Marketing site with a pricing page, FAQ, privacy and terms pages, and a one-click demo shop on the sign-in page.
• Sign-up with email and password, magic links, optional Google sign-in, and email verification when outbound email is configured. Onboarding for company size, spend, country, timezone and digest timing.
• Sources: manual add, a 48-tool quick-add checklist, a UPI Autopay mandate form, statement upload (CSV, XLSX, text-layer PDF with password support, dedicated HDFC, ICICI, SBI, Axis, Kotak, Yes Bank and Relay formats, and a column mapper), Plaid bank feeds, and Gmail and Outlook receipt scans.
• Rules-based detection over a catalogue of 534 vendors in 25 categories: weekly, monthly, quarterly, yearly and custom cycles, confidence scoring with a review queue, and duplicate, price-change and trial-converted flags.
• Subscription list with Keep / Unsure / Cancel tags, search, filters and sorting; detail panel; dismiss, merge, delete; user edits kept across detection runs.
• Overview, Reveal screen, renewal calendar, Actions queue with cancellation and negotiation email templates, savings tracker, offboarding.
• Hourly job for bank sync, detection, renewal reminders, manual charge checks, email alerts, digests and exchange rates.
• Owner, Editor and Viewer roles with email invites; accountant accounts with client workspaces.
• Free, Pro and Accountant plans with a 14-day Pro trial, Stripe Checkout, customer portal and webhook, and a script that creates the Stripe prices.
• CSV export, printable report, expiring share link.
• Manifest V3 browser extension for 20 vendor sites.
• Light and dark themes, mobile layout, installable web app with an offline page.
• Runs on Postgres with a self-creating schema, or embedded PGlite for local development.

Security#

• Bank, email, Slack and accounting tokens are encrypted at rest with AES-256-GCM.
• Production refuses to build or serve pages without its database, secrets, app URL and job secret.
• The job endpoint requires a secret in production; OAuth flows for Gmail, Outlook, Slack, TrueLayer, QuickBooks and Xero use single-use, expiring state.
• Stripe webhooks are signature-checked whenever Stripe is configured.

Version 0.1.0 also has known gaps, listed on Known limitations.