Private alpha

Changelog and known limits

What shipped, what broke and got fixed, and what does not work yet. We would rather you read it here than discover it mid-build.

June 2026

Email foundation and account welcome

New accounts now receive a one-time welcome email on first sign-in (OAuth and email/password paths).
Standalone email platform stack for the account welcome sequence and newsletters.
Published landing pages for the AI website builder, AI app builder, and the open-source CLI, plus Tauri desktop positioning on downloads.
Published transparent free, monthly, and annual plan comparisons without artificial scarcity.

June 2026

Closed an unauthenticated account-takeover and session-access hole found in internal review.
Rate-limited project-secrets writes and patched high-severity production dependencies; Dependabot now watches the tree.
The workspace entry point now refuses overtly malicious build intent.
Wrote and published the incident response runbook.

June 2026

Browser OAuth with PKCE: sign in from the terminal through codebase.design without copying API keys.
Scoped public API endpoints now accept OAuth bearer tokens alongside API keys.
Canonical production API base URL wired through the app.

May–June 2026

Fixed 500s on /security and /builds and a homepage crash from analytics running on non-Convex routes.
Activation now counts only real usage: a project must reach a successful preview within 24 hours.
Published production build limits (concurrency, queue, timeouts, ownership) at /builds.
Site-wide visual pass: dark glass theme defaults, shared catalog cards, full-height marketing navigation.

The honest list. If something here blocks you, tell us — alpha feedback is exactly how this list shrinks.

Builds: 5 concurrent production builds; queued builds wait their turn. Outer build turns time out at 15 minutes, sandbox phases at 3 minutes (details at /builds).
Desktop: the Apple Silicon macOS build ships today; Windows, Linux, and Intel macOS are queued — watch GitHub releases from /downloads.
CLI: public beta is available at /cli with shell, npm, and PowerShell install paths, browser OAuth, BYOK, local coding-agent workflows, and hosted web builds.
One-click deploy and custom domains: pipeline and infrastructure are live, self-serve UI is still in active development.
Email notifications: infrastructure is in place, but outbound product email stays off until our sending domain completes DNS authentication.
Community chat is feature-flagged and not yet broadly enabled.