Changelog

Security update (October 2026)#

Security fixes on top of 1.0.0, listed as "Unreleased" in the package's own changelog. The version number is unchanged.

Security#

• Demo mode is opt-in with YOURDESK_DEMO=1. It is only implied for a local trial (npm run dev on localhost with no DATABASE_URL). Anywhere else the demo account cannot sign in, and existing demo sessions are refused.
• The demo account is read-only while demo mode is on, enforced on the server, including password, email, profile and session changes. The app shows a notice.
• A production server refuses to start without BETTER_AUTH_SECRET when NODE_ENV=production, as in the Docker image and on Vercel.
• Automatic client emails are opt-in. Overdue-invoice reminders and proposal follow-ups are emailed only when the studio owner turns on Email clients automatically under Settings → Workspace → Mailbox. It is off for new and existing studios; otherwise they stay drafts.
• The Agent, Mail, Portals and Discover feature flags in Ops → Product are enforced on the server and hide the feature's navigation. With Portals off, portal links show as closed.
• Disabling a user in Ops → Users signs them out everywhere, blocks sign-in and refuses their server calls.

Before you update#

• Set BETTER_AUTH_SECRET (keep your existing value) before deploying with Docker or on Vercel, or the server will not start.
• Run the migrations as usual; this update adds 0020_auto_chase.sql.
• If your studio relied on reminders being emailed automatically, turn on Email clients automatically after updating.
• A public demo needs YOURDESK_DEMO=1. Running without DATABASE_URL no longer turns demo mode on outside a local trial.

See Demo mode, Automatic reminders, Configuration and Disabling an account.

1.0.0#

Released 21 September 2026. Initial CodeCanyon release.

Product#

• Dashboard and Today: what is due, overdue, waiting and next, built from the studio's own records.
• Discover: paste an enquiry to get a lead, questions to ask and research notes; answers carry into the proposal.
• Proposals: seven-page documents in eight looks, voice dictation, PDF download, a public link with open tracking, typed-name accept and sign, and a project created on signature.
• Projects: a four-lane board with subtasks, assignees, comments and files; Planner with .ics import and export; Time with timers, approvals and CSV export.
• Invoices: a live composer with 20 looks, tax, deposits, multiple currencies and FX rates, a public view link, PDF download, payment recording and overdue detection.
• Clients and client portals: one no-login link per client with progress, invoices, proposals, updates, messages, files, requests and deliverable approvals; on/off, expiry and link reset.
• Client updates with an IMAP and SMTP mailbox connection for sending.
• Agent: an xAI-powered helper with 42 tools, approvals for external, financial and destructive actions, undo for some actions, memories and saved automations.
• Team seats with invite links.
• Ops console: users, workspaces, product settings, plans, Stripe and PayPal checkout, system checklist and activity log.
• Email and password sign-in, and Google sign-in.
• Embedded PGLite database for local use; Postgres in production. Vercel, Docker and Node deployment targets.
• Light and dark themes, a responsive layout with a bottom tab bar on phones, and a web app manifest.

Security#

• Stripe webhooks require and verify the signing secret; only paid checkouts and live subscriptions activate a plan.
• PayPal capture reads the studio and plan from the order itself and checks the amount and currency against the plan.
• A client portal's on/off switch and expiry apply to every public action behind it: messages, uploads, access requests, answers and approvals.
• Studio-side portal posts, requests and deliverables check that the client belongs to the caller's studio.
• "Signup closed" is enforced for every sign-up path; pending team invitations are still accepted.
• Only the studio owner can start, change or downgrade the plan.
• Calendar import refuses private and internal addresses, re-checks each redirect, and limits size and time.
• Dependencies updated: @tanstack/react-start (an XSS fix) and nodemailer.

Version 1.0.0 also has known gaps, listed on Known limitations.