Changelog

What shipped, when.

Honest dates. No retroactive backfilling. Subscribe via the blog feed for major releases.

2026-05-06shipped

Federal wizard restoration · Supabase advisor closeout · tier-abuse migrations live

New free wizard: SSDI Request for Reconsideration — 20 CFR § 404.907, 60-day deadline tracker, surfaces functional limitations / treating providers / specific error in the initial determination so SSA must conduct a de novo review.
New free wizard: IRS CP2000 response — IRC §§ 6212-6213, 30-day window, optional § 6651(a) penalty abatement, reserves U.S. Tax Court rights.
New free wizard: Federal Rule 45 subpoena (FRCP 45) duces tecum — for compelling documents from the original creditor when a debt-buyer plaintiff cannot prove chain of title.
All three wizards wired into triage FSM, hub cards (/debt + /benefits), AI Counsel `recommend_wizard` catalog, homepage emergency-triage strip, /tools page, footer, and sitemap.
Supabase Security Advisor: closed `email_outbox` RLS error + 3 warnings (search_path, EXECUTE revoke, broad listing policy). 0 ERROR remaining.
Tier-abuse migrations 0062-0067 applied to production: signup fingerprint, à la carte entitlements, Case Pass lock, active sessions, profile role, admin audit log.
Documented 3 accepted-risk advisor findings in VULNERABILITY_REGISTER (intake_submissions / triage_events anon-INSERT policies, increment_ai_messages SECURITY DEFINER).
163/163 tests across 10 test files. Typecheck clean.

2026-05-02shipped

Labor & Employment forms · Document diff · Bulk import UI

Added 35 Labor Commission forms: federal DOL/EEOC/NLRB/OSHA + 25 state Labor Commission wage-claim and discrimination forms.
New /for-firms/labor-employment landing page with state-by-state filter chips.
In-app document version diff: word-level redline between any two regenerated versions.
Bulk import UI at /firm/import — paste/upload CSV from Clio / MyCase / PracticePanther.
Resend invite button on /firm/team for queued or failed seat invitations.
Public REST API expanded: time-entries, documents, document download.
Receipt PDFs auto-issued for every Stripe payment, surfaced on /firm/billing.
Time entry panel on each matter with one-click "push to Clio now".

2026-05-02security

Security hardening

Inbound email webhook: default-deny when secret missing; full-UUID matter token (no more prefix matching).
Receipt download enforces ownership (was IDOR-able).
API auth: empty scopes no longer grants wildcard access.
Cron routes (4) default-deny when CRON_SECRET unset.
firm/api-keys GET + DELETE now enforce firm_admin role for the key's org.
Receipt issuer UUID-validates path segments before storage upload.

2026-05-02fix

Marketing honesty pass

Integration statuses corrected: DocuSign / LawPay / Tyler now "beta" (routes exist), Clio sync clarified as push-only with inbound webhooks pending.
/for-firms/growth: removed unbacked claims (custom workflows, QBR call); replaced with the real public REST API + generic CSV import.
vs-MyCase compare table: client portal + time tracking columns now reflect what we actually ship.

2026-05-02fix

Homepage scroll-jack removed

The "How it works" section used a 300vh sticky horizontal carousel that read as a freeze on Windows desktops with mouse wheels.
Replaced with a normal vertical layout that uses in-view reveals — same visual rhythm, no scroll lock.

2026-05-01shipped

V5 launch — firms, forms, and pricing

Firm tiers: Solo / Small / Growth with white-label add-on.
Forms library: ~80 verified .gov forms, nightly re-verification.
Public REST API on Growth tier with bearer-token auth + rate limits.
White-label subdomain provisioning via Vercel Domains API.
Two-product split: pro se → Personal tiers; firm → Firm tiers.

Federal wizard restoration · Supabase advisor closeout · tier-abuse migrations live

New free wizard: SSDI Request for Reconsideration — 20 CFR § 404.907, 60-day deadline tracker, surfaces functional limitations / treating providers / specific error in the initial determination so SSA must conduct a de novo review.

New free wizard: IRS CP2000 response — IRC §§ 6212-6213, 30-day window, optional § 6651(a) penalty abatement, reserves U.S. Tax Court rights.

New free wizard: Federal Rule 45 subpoena (FRCP 45) duces tecum — for compelling documents from the original creditor when a debt-buyer plaintiff cannot prove chain of title.

All three wizards wired into triage FSM, hub cards (/debt + /benefits), AI Counsel `recommend_wizard` catalog, homepage emergency-triage strip, /tools page, footer, and sitemap.

Supabase Security Advisor: closed `email_outbox` RLS error + 3 warnings (search_path, EXECUTE revoke, broad listing policy). 0 ERROR remaining.

Tier-abuse migrations 0062-0067 applied to production: signup fingerprint, à la carte entitlements, Case Pass lock, active sessions, profile role, admin audit log.

Documented 3 accepted-risk advisor findings in VULNERABILITY_REGISTER (intake_submissions / triage_events anon-INSERT policies, increment_ai_messages SECURITY DEFINER).

163/163 tests across 10 test files. Typecheck clean.

Labor & Employment forms · Document diff · Bulk import UI

Added 35 Labor Commission forms: federal DOL/EEOC/NLRB/OSHA + 25 state Labor Commission wage-claim and discrimination forms.

New /for-firms/labor-employment landing page with state-by-state filter chips.

In-app document version diff: word-level redline between any two regenerated versions.

Bulk import UI at /firm/import — paste/upload CSV from Clio / MyCase / PracticePanther.

Resend invite button on /firm/team for queued or failed seat invitations.

Public REST API expanded: time-entries, documents, document download.

Receipt PDFs auto-issued for every Stripe payment, surfaced on /firm/billing.

Time entry panel on each matter with one-click "push to Clio now".

Security hardening

Inbound email webhook: default-deny when secret missing; full-UUID matter token (no more prefix matching).

Receipt download enforces ownership (was IDOR-able).

API auth: empty scopes no longer grants wildcard access.

Cron routes (4) default-deny when CRON_SECRET unset.

firm/api-keys GET + DELETE now enforce firm_admin role for the key's org.

Receipt issuer UUID-validates path segments before storage upload.

Marketing honesty pass

Integration statuses corrected: DocuSign / LawPay / Tyler now "beta" (routes exist), Clio sync clarified as push-only with inbound webhooks pending.

/for-firms/growth: removed unbacked claims (custom workflows, QBR call); replaced with the real public REST API + generic CSV import.

vs-MyCase compare table: client portal + time tracking columns now reflect what we actually ship.

V5 launch — firms, forms, and pricing

Firm tiers: Solo / Small / Growth with white-label add-on.

Forms library: ~80 verified .gov forms, nightly re-verification.

Public REST API on Growth tier with bearer-token auth + rate limits.

White-label subdomain provisioning via Vercel Domains API.

Two-product split: pro se → Personal tiers; firm → Firm tiers.