FormBuilder changelog

Trust & self-serve (Tier B)

Mon, 17 Aug 2026 00:00:00 GMT

**Public status page** at `/status`: a new 10-minute cron (`*/10 * * * *`, separated from the daily 14:00 jobs in `scheduled()`) probes API, database, R2 storage, the public-forms API path and the website, stores results in `status_checks` (migration 0021, 90-day retention), and `GET /api/public/status` summarises current state, 90-day uptime %, average latency and 30-day daily bars. **Public changelog** at `/changelog/` + `/changelog/feed.xml` (RSS): build-time SSG (`generate-changelog-page.mjs`) parses `CHANGELOG.md` — 263 entries grouped by day, type badges, internal "Ops to-do" notes scrubbed. **API reference** at `/developers`: every v1 endpoint with scopes, params, curl examples, response shapes, hook payload and limits (verified against `v1.ts` / `form-integrations.ts`). **Accessibility statement** at `/accessibility` (WCAG 2.1 AA target, known limitations, reporting path). **Self-serve session management**: logins now mint a `sessions` row and put its id (`sid`) in the JWT; `requireAuth` rejects revoked/expired sessions (older sid-less tokens keep working until expiry); `GET/DELETE /api/auth/sessions`, `POST /api/auth/sessions/revoke-others`; logout revokes its own row; Settings → "Active sessions" card (device/browser, IP, last active, sign out / sign out others). Migration 0020 adds `last_seen_at`/`revoked_at`. **Owner-facing activity log**: new `activity_log` table (migration 0022) + `logActivity()`; instrumented form created/published/unpublished/deleted, API key created/revoked, sessions revoked, password changed, Stripe connected/disconnected, subscription started/cancelled/retention-accepted; `GET /api/auth/activity` (paginated) and a Settings → "Recent activity" card. Footer links added (API, Changelog, Status, Accessibility); sitemap updated.

Billing & retention (Tier A)

Mon, 17 Aug 2026 00:00:00 GMT

Six standard-SaaS gaps closed in one pass. **Annual billing:** `STRIPE_PRO_ANNUAL_PRICE_ID` (Worker) + `VITE_STRIPE_PRO_ANNUAL_PRICE_ID` (frontend, passed through `deploy.sh`) enable a Monthly/Yearly toggle on Pricing ($390/yr = 2 months free); price validation, switch-plan and webhook plan-mapping accept the annual price. **Promo codes:** "Have a promo code?" in the payment modal → API resolves the customer-facing code via `/promotion_codes` and applies it as a subscription discount (clear error on invalid). **Real free trial:** first-ever subscriptions get `trial_period_days: 14` (card required, charged after); modal and pricing card say so, and the "30-day"/"no card required" claims on Pricing FAQ, Security and HIPAA pages were corrected. **Dunning:** new `invoice.payment_failed` webhook case marks the subscription `past_due` and sends a "payment failed — update card" email (amount, next retry date, billing + invoice links); Billing page shows a red past-due banner linking to payment methods. **Usage meter + warning:** `GET /api/billing` now returns `usage` (published forms, monthly responses vs plan limits), rendered as meters on Billing with an inline upgrade prompt at ≥80%; a daily cron (`sendUsageWarnings`) emails free users once per calendar month when they cross 80% (the existing held-response email covers 100%). **Win-back:** if `STRIPE_WINBACK_COUPON_ID` is set, the cancel modal offers the coupon ("Apply discount and stay"); `POST /api/billing/retention-offer` applies it once per user and records `cancellation_feedback.reason='winback_accepted'`.

Real respondent payments via Stripe Connect

Mon, 17 Aug 2026 00:00:00 GMT

The May payment field charged FormBuilder's own platform Stripe account, so owners could never actually get paid. Now owners connect their own Stripe account (Standard/OAuth) in **Settings → Payments** (new `PaymentsSettings` card: connect / connected-account status / disconnect) and payment fields create Checkout Sessions *on the connected account* (`Stripe-Account` header) — money goes straight to the owner, no platform fee. Migration 0019 adds `users.stripe_connect_account_id/status/connected_at`. New API `/api/stripe-connect` (status, authorize with HMAC-signed state, callback, disconnect). Submissions to a form with a payment field are refused (422 `PAYMENT_NOT_CONFIGURED`) until the owner connects — never charged to the platform. New public `POST /api/public/forms/:id/payment/confirm` verifies the Checkout Session server-side (must be paid *and* carry this response's id) before the public form shows the thank-you screen; the webhook and the confirm endpoint share one idempotent `finalizePaidResponse()` (services/payments.ts) so a response is finalized exactly once. Webhook route accepts the Connect webhook signing secret (`STRIPE_CONNECT_WEBHOOK_SECRET`) as a fallback. Public form now handles `?payment=success|cancelled` (verifying → paid / pending / error panels; cancelled shows an inline retry notice). Builder shows a Stripe-connection notice on payment fields.

Free plan: 5 forms + webhooks/Zapier/payments listed as included

Mon, 17 Aug 2026 00:00:00 GMT

`PLAN_LIMITS.free.forms` 3→5 (API create/publish caps) and `plans.ts` to match; webhooks were never plan-gated in the API, so the Free feature list now says so (Pro list de-duplicated). Copy fixed in pricing table, help center (3 places), templates page, integration pages' CTA fine-print (was claiming "Unlimited forms on the free plan"), and all comparison/alternatives pages (FormBuilder facts, competitor pricing analyses, FAQs).

Comparison-page accuracy

Mon, 17 Aug 2026 00:00:00 GMT

Feature matrix: Payments → Yes ("Stripe — paid to your own account, no platform fee"), Calculations & scoring → "Calculation field + auto-graded quizzes" (quiz grading shipped July 24), Webhooks → "All plans". Rewrote 12 competitor sentences that described FormBuilder payments as "Stripe/Zapier workflows".

Programmatic SEO: 26 static comparison + alternatives pages

Mon, 17 Aug 2026 00:00:00 GMT

Engineered-visibility play for AI assistants and search: new build-time mini-SSG (`frontend/scripts/generate-compare-pages.mjs`, runs after the integrations generator) renders `/compare/` (hub), 12 `/compare/formbuilder-vs-/` head-to-head pages, `/alternatives/` (hub), and 12 `/alternatives//` ranked buyer's guides. Tier-1 competitors: Typeform, Jotform, Google Forms, Microsoft Forms, SurveyMonkey, Tally, Formstack, Wufoo, Cognito Forms, Paperform, Fillout, MightyForms (acquisition-flavored). Each competitor is one rich data file (`compare-data/competitors/.mjs`: 3-paragraph overview, best/not-ideal-for, vendor-terms pricing table checked live on Aug 17 2026, pricing analysis, 25-row feature matrix, strengths/weaknesses, verdict + choose-X-if lists, 4-step migration, why-people-switch, 6–8 chatbot-phrased FAQs); FormBuilder facts live once in `compare-data/formbuilder.mjs`. Design per guidelines: scorecard hero artifact, charcoal verdict panel, side-by-side pricing decision tables, grouped feature matrix, S/W cards, numbered migration steps, FAQ, related pills, CTA band; verified via headless-Chrome renders desktop + narrow. JSON-LD: BreadcrumbList, Article (dateModified), FAQPage, ItemList (alternatives). `sitemap-compare.xml` + robots.txt Allow/Sitemap lines; footer gained Compare/Alternatives links. Adding a competitor = one data file + one registry line + rebuild.

Review-queue SLA alert false alarm on banned users' forms

Tue, 28 Jul 2026 00:00:00 GMT

The daily SLA email reported "5 form(s) waiting >24h" while the admin review queue was empty. Root cause: ban-takedown intentionally leaves `requires_review = 1` on a banned user's forms, and the SLA queries in `abuse-sweeps.ts` counted `forms.requires_review = 1` without checking owner status, while the admin queue filters on `u.is_active = 1` — so already-handled phishing forms (all 5 belonged to banned accounts) re-alerted daily forever. Both SLA queries now join `users` and require `is_active = 1`, matching the queue's definition of pending. Verified against production D1: fixed count query returns 0. No data cleanup needed — the flag on banned users' forms is intentional.

CTA realignment to draft-first across marketing surfaces

Sat, 25 Jul 2026 00:00:00 GMT

CTA audit found several pages still funneling visitors into signup/dashboard dead-ends instead of the draft-first builder. Fixed: all 138 static integration pages (nav "Get started free" + hero + closing-band CTAs went from `/register` to `/form-builder`), the Features page CTA band (was signup modal / dashboard, now "Create a form free" → builder), and all three blog CTAs (inline `---cta---` box, sidebar card, bottom band — all previously opened the signup modal). Every CTA now carries a `?src=` param and fires `create_intent_opened` with a per-surface source; the builder additionally logs a new `builder_opened` event with the `src` param on arrival, so per-page draft-conversion can finally be measured (homepage vs features vs blog vs integrations). Verified in headless Chromium: features CTA lands on `/form-builder?src=features`, blog post renders both new CTA links, no console errors.

MightyForms banner shortened + dismissible

Sat, 25 Jul 2026 00:00:00 GMT

The acquisition banner dropped its redundant middle sentence ("Existing MightyForms customers can still sign in." — the login link already says that) and "Read the announcement" became "Announcement". Added an × dismiss button that persists via localStorage (`mightyforms_notice_dismissed`), so returning visitors get the row back after one acknowledgment. Verified in headless Chromium including dismissal surviving reload.

Form editor nav simplification + standout Share button

Sat, 25 Jul 2026 00:00:00 GMT

The editor header dropped from ~10 controls to 6. The red Unpublish button is gone from the action row: the Live status pill is now a small dropdown (Live ▾ → Unpublish form), so the destructive action no longer sits next to Share competing for attention. Settings and Integrations merged into one Settings ▾ dropdown. The `email + Sign Out` text became an avatar menu (initial circle → email, Sign Out). Preview is now icon-only. Share was redesigned as the single primary CTA when a form is live: charcoal fill per design guidelines, semibold, rounded-full, shadow + ring, emerald live dot, icon micro-scale on hover — the only filled button in the bar (Publish takes that role on drafts). Also fixed: header dropdowns previously rendered underneath the Field Properties panel (header lacked a z-index). Verified with headless-Chromium screenshots (desktop + menus open). Known pre-existing issue, not addressed: the header action row overflows off-screen at phone widths.

Publish-gate AI review dedupe

Sat, 25 Jul 2026 00:00:00 GMT

The security gate re-ran a full AI review on every publish/save that carried publish state, even for identical content: one untrusted user's autosave burned 27 AI reviews in 2 minutes (41 total), and a blocked phisher's publish-hammering re-sent the review-queue email on every retry. The gate now hashes the scanned content (title, description, fields, thank-you/redirect/webhook) into KV (`pubscan:`, 7-day TTL) and reuses the prior verdict on a hash match — allowed verdicts skip the AI call entirely; blocked verdicts are honored only while the form is still `requires_review` so admin approvals always win. Pattern scans (cheap regex) still run every time.

Review-queue SLA alert email actually useful now

Sat, 25 Jul 2026 00:00:00 GMT

The daily "Review queue SLA" email was a bare count with no links. It now lists each stuck form (up to 20, oldest first) with title, why it was flagged (latest scan risk level + top finding descriptions), owner (name linked to their admin detail page, email, plan), and exact wait time, plus an "Open the review queue" button to /admin/security and a pointer to the batch rescan. Also added `GET /api/admin/security/sla-alert/resend` (manage_security permission) to re-trigger the alert on demand by opening the URL in a logged-in admin browser.

Integration pages redesign + main sitemap fix

Fri, 24 Jul 2026 00:00:00 GMT

The 138 `/integrations` pages got a full visual upgrade per DESIGN-GUIDELINES: hero product artifact (sample contact form → Zapier bolt → destination-app card with live-feed rows), subtle grid texture, stats strip, iconed workflow cards with a "Popular" flagship badge, a field-mapping panel artifact (form fields → app fields), numbered setup steps, animated-caret FAQ, app-monogram related pills, and a charcoal closing CTA band. Verified by actual headless-Chrome renders (desktop full-page + narrow), which caught unsized inline SVGs rendering giant. **Sitemap fix:** `formbuilder.com/sitemap.xml` was silently serving the SPA's index.html (Pages fallback shadowed the worker route — crawlers got HTML, not XML). The generator now writes a static `sitemap.xml` with 29 marketing/help URLs plus all 304 template pages (ids extracted from the same `src/data/templates/*.js` the template pages render from), 333 URLs total; static files always beat the SPA fallback.

Zapier integration: real REST-hooks app + public API expansion

Fri, 24 Jul 2026 00:00:00 GMT

FormBuilder now supports a genuine Zapier app (code in new `zapier/` dir, Zapier Platform CLI) instead of the old paste-a-webhook-URL approach. New v1 API surface behind the existing developer tokens: `GET /v1/me` (auth test), `GET /v1/forms/:id/fields` (field schema → Zapier dynamic output fields), `POST /v1/hooks` + `DELETE /v1/hooks/:id` (REST hook subscribe/unsubscribe, new `api_hooks` table, migration 0018, per-user cap 100, https + anti-SSRF validation). Triggers: **New Form Response** (instant — `dispatchApiHooks` fires from the submission pipeline alongside existing integrations; held over-cap responses never fire; `410 Gone` auto-deletes dead hooks; deliveries logged to `integration_logs` as `zapier_hook`) and **New Form** (polling). New `hooks:manage` token scope; revoking a token deletes its hooks. Settings gained an "API & Zapier" card (create/copy/revoke keys — first UI for the token system); the editor's webhook panel links to it. Free on all plans (matches Tally/Jotform/Typeform). Zapier app still needs `zapier register`/`push` from the Zapier account (see `zapier/README.md`).

Programmatic SEO: 138 static integration pages

Fri, 24 Jul 2026 00:00:00 GMT

New build-time mini-SSG (`frontend/scripts/generate-integration-pages.mjs`, runs after `vite build`) renders `/integrations/` (hub), `/integrations/zapier/` (pillar), and 136 `/integrations/zapier//` landing pages ("Connect FormBuilder to Salesforce/Slack/Notion/…") from a single dataset (`zapier-apps.mjs`: unique per-app blurbs + category use-case templates + custom flagship use cases). Fully static HTML on Cloudflare Pages — crawlable without JS, editorial design system, FAQPage + BreadcrumbList JSON-LD, per-category internal linking, `sitemap-integrations.xml`, robots.txt updated (static + worker), footer "Integrations" link. Growing the page set = appending to the dataset and rebuilding.

Owner-facing form analytics page

Fri, 24 Jul 2026 00:00:00 GMT

New `/forms/:id/analytics` page (linked from the responses page header) finally surfaces the analytics the API was already collecting but never showing anyone: views/starts/submissions/completion-rate stat tiles, a 30-day daily views-vs-submissions trend chart (inline SVG with hover tooltips, colorblind-validated amber/emerald palette with dashed-vs-solid line encoding), a respondent funnel (viewed → started → submitted with rates), and top countries. The existing `GET /api/forms/:id/analytics` endpoint gained `funnel`, `daily` (30-day series merged from `product_events` views and `form_responses` submissions), and `quiz` fields. No schema changes.

Quiz performance aggregates for owners

Fri, 24 Jul 2026 00:00:00 GMT

The analytics page shows a quiz block when a form has graded responses: average score, average percent, graded-response count, and a score distribution (0–19% … 80–100% buckets). Computed by new `summarizeQuizScores()` in the scoring service (unit-tested, 3 new tests) over the most recent 1,000 responses' stored `metadata.scoring.quiz`.

Autosave + resume for respondents

Fri, 24 Jul 2026 00:00:00 GMT

On forms with "save progress" enabled, answers now autosave to the respondent's browser (localStorage, 800ms debounce, 7-day expiry) as they type; returning respondents get the restore prompt (the previously-orphaned `ResumeFormModal`, now wired in) offering to continue where they left off, including the right page on multi-page forms. Cleared on submit or discard; server-side resume links (the existing manual "save progress" flow) take precedence when present. Closes the gap where leaving without clicking save lost everything.

Quiz functionality: auto-graded questions with respondent scores

Fri, 24 Jul 2026 00:00:00 GMT

Radio, select, checkbox, and text fields can now be marked as quiz questions in the builder (correct answer + points, checkbox answers require the exact set, text matches case-insensitively). Grading runs server-side on submission via the existing scoring service and is stored in `metadata.scoring.quiz` on each response. Respondents see a score card on the thank-you screen ("7 / 10 — 7 of 10 questions correct") unless the owner turns off the new "Show Quiz Score" toggle (settings → General, appears once a field has a correct answer; stored in new `forms.quiz_settings` column, migration 0017). Owners see the score plus per-question Correct/Incorrect badges in the response detail modal. Security: answer keys live in field settings and are stripped from all public form payloads — respondents can never fetch the key, and grading happens server-side only.

47 new templates closing every AI-demand gap + new Logistics category

Fri, 24 Jul 2026 00:00:00 GMT

The July 24 template review cross-referenced ~120 production AI-generator prompts against the library and shipped templates for every recurring theme with no coverage: *Education* 4→16 (multiple-choice quiz, exam answer sheet, class test, student assessment, assignment submission, primary school enrollment, daycare registration, college application, attendance sheet, parent-teacher conference signup, field trip permission slip, mentorship matching); *new Logistics category* (delivery note, delivery order, proof of delivery, delivery incident report, delivery driver application, courier pickup request); *audits & inspections* (store audit, site survey, internal audit checklist, RCSA, workplace safety inspection, general inspection checklist); *HR* 6→13 (supervisor feedback — the demanded supervisor-selection variant, leave request, overtime request, shift swap, performance self-review, workplace incident report, onboarding checklist); *Food & Beverage* 3→9 (restaurant customer review with dine-in/takeaway/drive-through split, takeaway feedback, online food order, private event booking, menu item survey, delivery driver signup); plus refund request, roadside assistance, car rental booking, equipment rental, visitor sign-in sheet, group volunteer registration, dance workshop registration, early access signup, dormant account reactivation, and training feedback survey. Every template has a distinct theme (varied palettes and font pairings). Contract test extended with the full id list. Note: quiz/exam templates collect answers only — no grading engine yet (next conversation).

Template search analytics never logged

Fri, 24 Jul 2026 00:00:00 GMT

`logTemplateSearch` existed and the `/api/template-search` endpoint worked, but no page ever called it, so the admin Template Searches dashboard has been empty since launch. The templates page now logs settled searches (800ms debounce) with result counts, so future template-gap decisions can run on real zero-result search data.

Unsubscribe audit: every recurring email now has a logged-out opt-out

Fri, 24 Jul 2026 00:00:00 GMT

Conditional-notification recipients (form-integration emails with no stored recipient row) previously had NO unsubscribe link; they now get an HMAC-signed `/unsubscribe-notifications/:payload` link (login-free, tamper-rejecting, warm-paper pages) with opt-outs persisted in KV and filtered before every send. Backfilled the one production recipient row missing an unsubscribe token. All three unsubscribe flows (marketing/lifecycle, per-form recipient, conditional) verified live and logged out end-to-end.

Email round 2: full lifecycle coverage + deliverability hygiene

Fri, 24 Jul 2026 00:00:00 GMT

(1) *Create nudge* (code 100): signed up 24h+ ago with zero forms → starter ideas + template/AI links; completes the nudge ladder (signup→create was the funnel's biggest single drop at 47%). (2) *Weekly digest* (code 103, Mondays): owners whose forms had views/responses in the last 7 days get "Your week on FormBuilder: X views, Y responses" with a per-form table; quiet accounts get nothing. (3) *Unsubscribe hygiene*: all lifecycle sends now carry an unsubscribe footer to the (restyled, warm-paper) `/marketing-unsubscribe` page; List-Unsubscribe header not possible with the current EMAIL binding shape (no headers field) — revisit if the binding changes. (4) *Bounce suppression*: provider-reported permanent bounces are logged as `bounced`, and any recipient with a bounce or 3+ failures and no successes in 30d is skipped (`suppressed` log status) to protect sender reputation. (5) Deleted the never-wired `welcomeSeries` day-2/5 drip templates and `sendWelcomeSeriesDay` dead code. Admin preview endpoint now sends all five sample emails.

Lifecycle activation emails

Fri, 24 Jul 2026 00:00:00 GMT

The product now follows up after the two moments where funnels die. Daily cron sends (once per user, future accounts only, `marketing_emails_enabled` respected): a *draft nudge* when a real draft (3+ fields) sits unpublished for 24h with nothing else live, and a *share nudge* when a published form still has zero views after a day — including the live link, a mailto share shortcut, and a deep link that reopens the share modal. The first response a form ever receives now sends a celebration variant ("🎉 Your first response") with momentum copy. All email templates restyled to the editorial design system (warm paper, charcoal CTAs — the retired blue chrome is gone from every email). Send history in `welcome_series_emails` (codes 101/102); admin preview endpoint `POST /api/admin/lifecycle/preview-emails`.

Dashboard visibility for the zero-views problem

Fri, 24 Jul 2026 00:00:00 GMT

Published form cards now show view counts, and a live form with 0 views and 0 responses gets an amber "No views yet — share your link" callout that opens the share modal. Publishing from anywhere on the dashboard now opens the share modal immediately (the share moment), instead of just a toast.

Persistent Share in the editor

Fri, 24 Jul 2026 00:00:00 GMT

A published form's editor nav now leads with a charcoal Share button (reopens the share modal any time); Unpublish is demoted to a quiet text action. Publish/Share buttons restyled from retired blue to charcoal.

Free plan form cap now binds at publish, not create

Fri, 24 Jul 2026 00:00:00 GMT

Drafts no longer count against the 3-form free cap (production data: 72 free users were locked out of creating anything, 49 of them without ever publishing; templates — the #1 creation method — hit an upsell wall). Creation is now effectively unlimited (anti-abuse ceiling of 100 total forms), and the cap is enforced when transitioning a form to published (402 `PLAN_FORM_LIMIT_REACHED`, counts other published forms only so republishing never trips it). Removed the client-side 3-form block on the templates page.

Dashboard "Get your first response" alert could unpublish a live form

Fri, 24 Jul 2026 00:00:00 GMT

The alert targeted `forms[0]` blindly: its "Publish" button *toggled* publish state (silently unpublishing an already-live form) and "Copy link" could copy a draft's dead URL. It now spotlights a live form awaiting its first response (Copy link / Share / Send test) or the newest draft (Publish, which then opens the share modal), and never copies unpublished links.

`anonymous_publish_instant` events were silently dropped

Fri, 24 Jul 2026 00:00:00 GMT

The instant-publish success event fired by the frontend was missing from the server's `allowedEventNames` whitelist, so the new flow's key metric never recorded. Also: template usage now fires `template_selected` and `form_created` product events (the #1 creation path was invisible in the create funnel).

Held responses: the free cap stops losing data and becomes the upgrade moment

Thu, 23 Jul 2026 00:00:00 GMT

The free plan's 100 responses/month cap previously rejected the respondent's submission with an error (data lost, form looked broken, upgrade prompt shown to the respondent instead of the owner). Now forms keep collecting: responses past the cap are stored with `metadata.held = true`, locked from viewing/export/API while the owner is on free, and unlock instantly on upgrade. Held responses skip webhooks/integrations and send a "New response waiting" teaser notification. Owners see a warm-paper banner on the responses page ("N responses are waiting — upgrade to unlock") and locked rows show a quiet lock chip.

Visible usage meter

Thu, 23 Jul 2026 00:00:00 GMT

`GET /api/forms` now returns accurate monthly `response_usage`; the dashboard Plan card shows "34 of 100 responses this month" with a thin progress bar (charcoal, amber past 80%), and the near-limit alert uses real monthly usage instead of all-time counts. Response notification emails carry a quiet usage footer once past 50% of the cap. Pricing page and plan catalog updated to state real boundaries (held responses, badge removal, post-submit redirects on Pro).

Publish-first anonymous flow

Thu, 23 Jul 2026 00:00:00 GMT

Clicking Publish as an anonymous builder now creates the account from the email alone, runs the full security pipeline, publishes instantly, and shows the live link + share panel on the spot; the emailed magic link became the account *claim* mechanism (7-day expiry, "Your form is live 🎉" template) instead of an inbox gate. Existing-account emails still fall back to the magic-link flow (we never start a session on an unproven email). Abuse valves: unclaimed accounts' forms pause at 10 responses and auto-unpublish after 7 unclaimed days (daily cron, with a fresh claim link emailed). Motivated by funnel data: 118 anonymous publish clicks → only 20 completions, with 92% of magic links clicked within 2 minutes or never.

Iron-clad scanner upgrades

Thu, 23 Jul 2026 00:00:00 GMT

`normalizeScanText` now folds Unicode homoglyphs (Cyrillic/Greek "pаsswоrd"), NFKC-normalizes fullwidth/styled text, strips diacritics and zero-width chars; credential terms in 15 languages added to both the pattern scanner and the non-negotiable credential hard-block (previously "Contraseña"/"Пароль" fields sailed through untouched). New evasion-corpus test suite (`scripts/security-scanner.test.ts`). AI review now runs on EVERY publish by untrusted accounts (new/unverified/unclaimed), not just pattern-flagged ones — non-English or creatively-phrased harvesting can no longer skip Claude; AI outage on a pattern-clean publish fails open but flags the form and emails the alert list.

Bait-and-switch defense

Thu, 23 Jul 2026 00:00:00 GMT

Field create/update/delete and version restore on a *published* form now re-run the full scan pipeline (previously never rescanned: publish benign, rename a field to "Password", stay live); suspicious verdicts auto-unpublish + flag + alert.

Behavioral defenses

Thu, 23 Jul 2026 00:00:00 GMT

Trust tiers (`api/src/services/trust.ts`); post-submit redirect URLs restricted to established/paid accounts; disposable-email rejection on instant publish; auto-suspend + full takedown on a second suspicious form per account; "Report this form" link in the public-form branding bar (2 distinct-IP reports auto-pause + alert); credential-pair tripwire pauses any free-tier form whose responses start looking like email+password pairs (3 strikes); admin `POST /users/:userId/ban-takedown` one-click action; daily review-queue SLA re-alert for anything pending >24h.

YouTube tutorial video pipeline + "How To Create a Form" video

Thu, 23 Jul 2026 00:00:00 GMT

New `promo/` toolkit: `promo/record/record.mjs` (Playwright, drives production formbuilder.com with an injected visible cursor, records 1920×1080 beats with a marker manifest) and `promo/remotion/` (Remotion 4 composition: editorial intro/end card, macOS browser frame, step captions with serif-italic accents, Ken Burns zooms, cross-fade/slide transitions, Nihilore CC-BY music bed). Builder footage recorded on production; respondent clip recorded locally (prod Turnstile correctly blocks headless submits). Output: `promo/dist/how-to-create-a-form.mp4`. Demo account `demo@formbuilder.com` (pro, verified) with one live "Customer Feedback Survey" form remains on production for the video.

Credential-collecting fields always block publishing — hard rule, never AI-adjudicated

Thu, 23 Jul 2026 00:00:00 GMT

Per policy, any text-input field whose label captures a password/passcode/PIN/OTP/CVV/seed phrase (including leetspeak and asterisk-obfuscated variants) returns a `suspicious` verdict in `aiReviewFlaggedForm` before the model is consulted, and the review prompt no longer allows "internal IT password form" as a benign rationale. Motivated by the backfill: the AI cleared a "Change Password" form collecting Old/New Password.

Verification emails actually send now

Thu, 23 Jul 2026 00:00:00 GMT

Registration fired `sendWelcome` without `ctx.waitUntil`, so Cloudflare Workers cancelled the promise when the response returned: production `email_delivery_logs` show **zero** welcome/verification emails across all 290 signups since logging began April 30 (magic-link emails, which are awaited, sent fine). 57% of all users (455/804) are unverified as a result. The send is now wrapped in `c.executionCtx.waitUntil` (`api/src/routes/auth.ts`).

Unverified users no longer locked out of sharing

Thu, 23 Jul 2026 00:00:00 GMT

The share link was withheld from unverified users purely client-side (the server never enforced it; published forms were always publicly reachable): the legacy builder showed a "Published (Private) — verify to unlock the shareable link" banner instead of the share panel, the publish modal warned the link was "locked until email verified", and the dashboard publish toggle hard-blocked with a dead-end toast. Combined with verification emails never sending, this stranded publishers with no URL — the main cause of the create→publish collapse (only 75 of 428 form creators ever published; 215 users abandoned drafts with 6+ fields). All three blocks removed; unverified owners of a published form now see a dismissible verify-email nudge with a working "Resend verification email" button (`frontend/src/legacy/pages/FormBuilderPage.jsx`, `frontend/src/pages/DashboardPage.tsx`).

Admin backfill endpoint `POST /api/admin/users/backfill-verification`

Thu, 23 Jul 2026 00:00:00 GMT

Batched send of the standard verification email to unverified active users who never received one (skips anyone with a logged sent verification email, so runs resume cleanly). Supports `{ limit, dry_run }` plus targeting filters `{ min_fields, days }` (only users owning a form with >= min_fields fields touched in the last N days). Built for the 455 users stranded by the dropped-email bug. Targeting dry-runs on July 23 showed the intended segment (5+ fields, 14 days) contains zero real users — everyone stranded is 30+ days stale (127 all-time, 33 within 180 days, 5 within 90) because the magic-link flow auto-verifies all recent serious builders. No live send has been fired.

Security scanner no longer scans random field IDs

Thu, 23 Jul 2026 00:00:00 GMT

`evaluatePublicPublishSafety` passed `field.name ?? field.id` into the content scanner, but `form_fields` has no `name` column, so every field's UUID was scanned as content; hex IDs containing "2fa"/"2f4" (leetspeak-normalized) flagged benign forms as high-risk phishing (~1.5% chance per field) and permanently blocked publishing. Confirmed in production: a school enrollment form was blocked because a field ID contained `-2fa8-`.

AI form generator reliability

Thu, 23 Jul 2026 00:00:00 GMT

Turnstile tokens are single-use but the frontend reused a consumed token on retry (guaranteed 403); tokens now reset after every attempt. Rate limit raised 2/min → 6/min (iterating users hit 429 on their third prompt). Claude call now retries once on 403/429/5xx (production 403s from Anthropic proved sporadic, not a dead key — last success July 23; same retry added to the AI publish review), model updated `claude-sonnet-4-5` → `claude-sonnet-5`, and failure events now capture the server error message. NOTE: the dominant production failure (97 occurrences through July 21) is the Anthropic API rejecting `CLAUDE_API_KEY` with 403 "Request not allowed" — the key itself needs attention in the Anthropic console.

Anonymous publish flow survives cross-device magic links

Thu, 23 Jul 2026 00:00:00 GMT

The builder draft only lived in `localStorage`, so opening the magic-link email on a different device (build on desktop, tap link on phone) silently lost the form. Drafts now ride along with the magic-link request and are stored server-side in KV (24h TTL); login returns the draft and the existing client-side save/publish flow runs from it. localStorage remains as fallback for pre-change links.

AI second-opinion review for flagged publishes

Thu, 23 Jul 2026 00:00:00 GMT

Forms flagged above "low" risk by the pattern scanner are now adjudicated by Claude (`api/src/services/ai-review.ts`) before blocking: benign verdicts publish immediately (scan recorded as `approved`/`ai`); suspicious verdicts or AI errors block as before and email `ALERT_EMAIL_RECIPIENTS` — which was `""` in production (review emails never sent to anyone, review queue sat at 66 pending / 0 ever approved); now set to me@evangower.com.

Admin backfill endpoint `POST /api/admin/security/rescan-blocked`

Thu, 23 Jul 2026 00:00:00 GMT

Batched re-scan of forms stuck with `requires_review = 1` using the fixed scanner + AI review; benign forms are unblocked (flags cleared, scans approved) and owners get a "your form is ready to publish" apology email; suspicious forms stay blocked and are listed in the response. Supports `{ limit, notify, dry_run }`.

Post-publish share moment

Thu, 23 Jul 2026 00:00:00 GMT

Publishing from the editor now opens a share modal (link, QR, embed, social) instead of just a toast; `ShareModal` extracted from the dashboard into `frontend/src/components/ShareModal.tsx` and the previously-dead `?published=true` redirect param from the anonymous flow now triggers it too. Motivated by production data: 58 of 115 published forms had zero views ever, while forms with 5+ views got responses 70% of the time.

Response notifications on by default for verified owners

Thu, 23 Jul 2026 00:00:00 GMT

New forms created by a verified user get `email_notifications_enabled = 1` with the owner as a verified recipient; when a user verifies their email, notifications switch on for their existing forms that never had recipients configured (`api/src/services/default-notifications.ts`).

JWT session revocation

Wed, 22 Jul 2026 00:00:00 GMT

Tokens now carry a per-user `sv` (session version) claim checked on every authenticated request (migration 0015) · Password change, password reset, and admin suspend now invalidate all outstanding tokens; self password change re-issues a fresh session

PBKDF2 iterations stay at 100k — Workers platform cap discovered

Wed, 22 Jul 2026 00:00:00 GMT

A 600k raise was attempted per OWASP but Cloudflare Workers WebCrypto hard-rejects PBKDF2 above 100,000 iterations at runtime; reverted after it briefly broke production registration (caught and hotfixed within minutes during post-deploy testing). Raising further requires moving off WebCrypto.

Rate limiting keyed on IP only

Wed, 22 Jul 2026 00:00:00 GMT

Rotating the User-Agent no longer resets a client's quota; `rate_limits` table DDL moved from runtime to migration 0016