Changelog

Website

• Homepage rebuilt on native WordPress blocks (Twenty Twenty-Five) – roughly 90% lighter markup with no page-builder dependency
• New interactive demos – before/after tag wiper, AI-tag hotspot photo, and an industry thumbnail marquee, all dependency-free CSS
• New pages – pricing, competitor comparisons (Pics.io, Bynder, Canto), about, Product Hunt, and a technical Show HN brief
• This changelog is now post-driven – each release is a standard post rendered as a release card, with its own URL and RSS entry
• Codebase stats on /show-hn and /product-hunt now auto-generate at deploy time – they cannot drift from reality again
• 30-day money-back guarantee added to all plans

Newly Added

• Application Passwords opt-in (AUTH-1) – users can enable WordPress application passwords per-account to connect MCP/agent tooling to their library
• AWS cost tripwire ladder – documented alerting thresholds so lifetime-deal economics stay protected as usage grows

Bug Fixes

• Followed FluentCart 1.6 subscription hook rename (cancelled to canceled) – storage add-on revocation continues to work correctly on subscription cancellation

Improvements

• Composer dependencies updated, including adaptation to wordpress-stubs 7.1 for PHPStan analysis
• npm dependencies updated within semver; eslint-plugin-react-hooks pinned at 7.0.1 for lint stability

Improvements

• StaleProcessingAssetSweeper extracted – removed the last Container::get() call; the entire codebase now resolves dependencies through the DI container
• Architecture Decision Records introduced – significant design decisions now documented in docs/adr/ for future maintainers
• Docs corrected – Free-tier storage claim fixed and stale codebase metrics refreshed

Bug Fixes

• Fixed missing useCallback dependency in useProjectSync that could leave project views showing stale data

Newly Added

• Admin role activated across the full RBAC surface – team admins can now manage members, projects, and workspace settings
• Direct LTD checkout gate – the on-site purchase endpoint is now behind PICTABASE_ENABLE_DIRECT_LTD so it can be toggled per channel
• Integration test harness – wp-phpunit suite boots the real WordPress stack for end-to-end coverage alongside the unit suite
• Release stamping – every deploy writes commit, tag, and UTC timestamp to RELEASE.txt for provenance

Improvements

• Unified quarantine code generation – one provisioning path for AppSumo, direct LTD, and remediation flows
• Email pipeline extracted – EmailTemplateRenderer and EmailHookRegistrar pulled out of the provisioning service for testability
• Lightbox performance – S3 presigned URLs now cached via WordPress transients, eliminating double-loads
• Storage quota thresholds standardized – amber warning at 80%, hard lockout at 100%, consistent across upload area, quota bar, and account page

Bug Fixes

• Pre-launch audit remediation (Batches A-L) – atomic rate-limit counters, atomic job claims, deduped asset creation, N+1 collapses in invitations and project queries, and deferred sidecar writes
• Closed four WordPress-default attack surfaces identified in the auth audit
• Rate-limited public invitation-token endpoints and hardened share-link / AI-scan paths
• Fixed DI wiring for WebhookPayloadParser and null-safe post field handling

Newly Added

• Direct LTD checkout flow – Seamless on-site purchase with FluentCart integration, magic redirect to account, and 4-code cap enforcement
• Code vault system – Secure redemption, quarantine, and refund handling with channel segregation (AppSumo vs direct)
• Dynamic pricing display – Single source of truth for LTD pricing across frontend and backend

Improvements

• Security hardening – Foundation audit completed with F2/F4/F5/F9 data-leak protections, interface extractions for testability, and strict UTC discipline
• Test coverage expansion – 50+ new unit tests covering license provisioning, entitlement services, asset deletion, and account state management
• Code quality – Split god-objects into SRP-aligned controllers, extracted interfaces for dependency injection, and removed wpdb dependencies from service layer
• Documentation – Comprehensive operational launch checklist, AppSumo reviewer FAQ, and security whitepaper updates

Bug Fixes

• Fixed asset position jump on rotation
• Fixed Project screen scrolling issues
• Fixed lightbox zoom passive wheel warning
• Fixed LTD channel edge cases for refunded users

In Development

• Advanced Metadata & Taxonomy Management:Enhanced tools for large-scale library maintenance, including the ability to merge categories, mass-rename terms, and manage complex tag hierarchies to prevent “metadata bloat” as your library grows.
• Agency-Scale Batch Export Engine: Note: This is an infrastructure-intensive feature slated for Advanced Tier/Agency add-ons.

Under Consideration

• Native WordPress Gutenberg Integration:A seamless bridge between your PictaBase library and the WordPress editor. This feature will allow you to browse, search, and insert assets directly into your pages and posts without ever leaving the block editor or manually re-uploading files.
• Interactive Client Proofing & Selection Evolving our current sharing capabilities into a two-way collaboration tool. This update will allow external clients to “Favorite,” “Approve,” or “Reject” specific assets within their branded galleries, with real-time status syncing back to the PictaBase dashboard.
• Facial Recognition: Automated person detection and matching across your entire photo library. This feature uses AWS Rekognition to identify faces in new uploads and automatically match them against existing face collections, making it effortless to find “all photos of this person” without manual tagging.

Newly Added

• Engineering resources for this patch were dedicated exclusively to infrastructure maturity rather than feature expansion, ensuring the core engine is hardened for the initial user influx.

Improvements

• This update prioritizes launch-day stability and support responsiveness. By upgrading internal telemetry for AI processing, the platform is equipped for faster incident resolution during high-traffic periods. Background job reliability was reinforced with strict UTC discipline and improved retry logic to ensure consistent performance across global server regions.

Bug Fixes

• n/a

Newly Added

• Launching the foundational PictaBase engine, built for professional-grade visual asset management. Key capabilities include native AWS S3 integration with signed CloudFront delivery, AI-driven metadata extraction, and a hierarchical taxonomy system tailored for complex industry workflows. The release also includes a robust stacking system supporting up to 4 AppSumo codes.

Improvements

• This release established an enterprise-grade codebase by enforcing 100% strict typing and zero-error PHPStan Level 8 static analysis. Security was a primary focus, resulting in a custom embedded authentication flow that eliminates traditional CMS vulnerabilities and rigorous header validation to protect asset security.

Bug Fixes

• Initial stabilization efforts addressed critical session synchronization and UI state hydration to ensure a seamless onboarding experience. Fixes also included filename normalization for cross-OS compatibility and mathematical edge-case handling for high-tier license stacking.