Matthew Meszaros
1701e016a6
feat: replace the Open Graph card's inbox screenshot with the home page hero's Accounts dashboard over the same sky background, at half the previous file size
2026-10-09 18:34:21 +02:00
Matthew Meszaros
ebe3e38550
feat: delete the marketing components no page uses after the redesign (PageHero, Section, SectionHead, SectionSky, PaintedSky, Cloud, HeroAtmosphere, HeroSparks, UseCasePage, Button, Eyebrow, AppFrame and the old inbox, sequence, warmup and integrations mock screens)
2026-10-09 18:34:21 +02:00
Matthew Meszaros
8c415d0982
feat: redesign the about, trust, changelog, brand, referral, FAQ, contact and 404 pages, with a plain contact email card, a dark Discord scene and a docs search scene on the contact page, and a 3 KB WebP of the social logo for every chat avatar
2026-10-09 18:34:21 +02:00
Matthew Meszaros
56037bc998
feat: redesign the use-cases overview and the founders, sales, agencies, recruiters and fundraising pages, each with its own scenes and layout instead of one shared template
2026-10-09 18:34:21 +02:00
Matthew Meszaros
5f48f9e86e
feat: redesign the pricing page around a plan comparison table with plans from the app's plan list, stacked plan cards with a monthly or yearly toggle on phones, and a sideways-scrolling comparison with the feature column pinned
2026-10-09 18:34:21 +02:00
Matthew Meszaros
2a2c2aca91
feat: redesign the inbox, CRM, analytics, automations, integrations and developers pages with dashboard-faithful scenes and copy checked against the guides, and show Warmbly's social logo as the app avatar on its Slack messages
2026-10-09 18:34:21 +02:00
Matthew Meszaros
6e15524ef0
feat: redesign the warmup, deliverability, sending and campaigns pages with dashboard-faithful scenes, documented thresholds and defaults, and phone layouts that stack the health bands and sending posture instead of squeezing them into columns
2026-10-09 18:34:21 +02:00
Matthew Meszaros
e39db98a02
feat: restyle the blog index, tag pages, post layout, covers and tag filter to the new site design
2026-10-09 18:34:21 +02:00
Matthew Meszaros
ff1d9ca07d
feat: give the landing page a clean white hero with a one-to-one Accounts dashboard mockup, an accurate Automations section with four documented callouts and greyscale integration rows that colour on hover, and a simplified pricing block
2026-10-09 18:34:21 +02:00
Matthew Meszaros
31d6e2c5e7
feat: rebuild the marketing site shell with a clean header carrying a GitHub stars button read at build time and a full-width mega menu with photo tiles, page guide lines, shared Rule, SectionIntro, Faq and BrandMark primitives, a photo-band closing CTA, restyled legal pages, article tables that scroll sideways on phones, and a global rule that stops any grid column from widening the page
2026-10-09 18:34:21 +02:00
Matthew Meszaros
a4dd7e70b9
feat: serve the marketing site photos through astro:assets as AVIF with WebP fallback, responsive widths and an inline blurred placeholder via a new Photo component, move the textures into src/assets, cache built assets immutably, and let ScaledStage render a plain frame when no photo is given
2026-10-09 18:33:49 +02:00
Matthew Meszaros
e41587d404
feat: replace the landing page feature showcases with a photo-backed bento and a numbered how-it-works section whose live dashboard scenes (accounts, warmup, campaign flow, deliverability, inbox, AI editor, deals, analytics, installer) mirror the app and animate only while on screen, and drop the old showcase components, mock screens and grain shader
2026-10-09 15:56:17 +02:00
Devin AI
4cad34c84a
feat: retain signup attribution through same-path marketing query navigation and reject cross-origin landing paths
2026-10-09 07:36:25 +00:00
Devin AI
6af3ba910c
feat: preserve cookieless first-touch signup attribution through marketing and app redirects and expose admin referrer hosts
2026-10-09 07:19:23 +00:00
Matthew Meszaros
dcf9067b00
feat: floor sharp at 0.35.5 through the site and docs pnpm-workspace overrides and refresh both lockfiles, replacing the site's stale note about the 0.35 line
2026-10-07 19:36:11 +02:00
Matthew Meszaros and Devin AI
dfed1e1593
feat: validate API UUIDs, recover expired Gmail history and guard consumer startup and stale frontend assets
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-07 07:19:15 +00:00
Matthew Meszaros and Devin AI
63bb192a40
feat: patch vulnerable production frontend dependencies across dashboard admin site docs and forms and preserve site cursor type narrowing
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-06 13:38:12 +00:00
Matthew Meszaros
69f2fef943
feat: move the flow canvas zoom controls to the bottom left, clear of the assistant launcher, in the app and the site mocks
2026-10-06 05:29:09 -07:00
Matthew Meszaros
e05c22a761
feat: sync the site's automation and campaign builder mocks and campaigns page to the two-line cards, quiet lines, dot-grid canvas and toolbar row, and document canvas navigation
2026-10-06 05:23:57 -07:00
Matthew Meszaros
aa63ed9a4f
feat: redraw the site's campaign builder mock, campaigns page builder and hero fragments as the self-laying tree canvas with wait chips, column pills and End terminals, and drop dot and drag wording from the switch step editor
2026-10-05 22:19:23 -07:00
Matthew Meszaros
63ae572345
feat: keep the connector + button under the pointer on hover, open the step picker beside the cards, top-anchor the first view, and update the automation docs, the site's builder demo and branching copy, and a proof flow for the tree builder
2026-10-05 21:56:30 -07:00
Matthew Meszaros
e506544119
Merge origin/main into feature/admin-redesign
2026-10-05 03:01:22 -07:00
Matthew Meszaros
8910b02198
feat: redesign the admin panel in a black and white dark-first theme with grouped sidebar sections, header tabs, a collapsible animated sidebar and a rebuilt sign-in, alert operators on admin sign-ins and admin access changes through opsnotify, and carry first-touch attribution from the marketing site to every dashboard link
2026-10-05 03:01:22 -07:00
Matthew Meszaros
36149cdebd
feat: add Pipedrive CRM mode (migration 000262) with write-through deals, activities and notes, outreach logged as Pipedrive activities, per-connection webhooks, filter import, a Warmbly person panel and modals, a provider registry behind the shared /crm routes, a provider-aware dashboard, and centered popups replacing the integration side drawer
2026-10-04 19:20:48 +02:00
Matthew Meszaros and Devin AI
e9430e96d1
feat: add Mindroot Ltd's ICO data protection fee registration reference ZB958997 to the Who we are section of the privacy policy and bump its last updated date
...
Co-Authored-By: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
2026-10-04 14:06:30 +00:00
Matthew Meszaros
ab39429e37
feat: send HSTS from the forms service only on FORMS_DOMAIN and strip it in the installer's Caddy block for customer-owned domains, so no customer apex is pinned to HTTPS
2026-10-04 05:19:22 -07:00
Matthew Meszaros
35635afeff
feat: refuse to store webhook and OAuth app signing secrets without CREDENTIALS_ENCRYPTION_KEY and never hand out an unreadable sealed secret, require TLS 1.2 on IMAP sync connections, compare the first-run setup token in constant time, and serve customer-owned domains from the installer's Caddy without HSTS
2026-10-04 03:42:36 -07:00
Matthew Meszaros
e852a106a9
feat: serve every node-only internal route (data keys, message map, sync lookups, worker config, fleet heartbeat) on NODE_BROKER_TOKEN and leave only tracked links, domain redirects, page hits and forms on INTERNAL_API_TOKEN, render nodes only the node token when one is set, and have the installer generate a distinct NODE_BROKER_TOKEN for new installs and its own UPDATER_TOKEN
2026-10-04 03:21:58 -07:00
Matthew Meszaros
59f6d72d3b
feat: bump docs to next 16.3.8, site to patched devalue and http-cache-semantics, and realtime to mint 1.11.0, gate the security workflow on called Go vulnerabilities with a fixed version and on retired or upgradable Hex packages through scripts/govulncheck-gate.sh and scripts/hex-audit-gate.sh with a new Elixir audit job, and keep advisory ids and reachability notes out of .trivyignore, mix.exs and the site pnpm workspace
2026-10-04 02:57:17 -07:00
Matthew Meszaros
32da32a0a8
feat: mask every revealed secret in session replay by tagging API key, client and signing secrets, inbound webhook URLs, join commands, tester passwords, pairing codes and the TOTP QR, block inputs holding credentials, mask token, session and code URL parameters in dashboard analytics, give the admin panel the same masking with console recording off, and update the privacy page to match
2026-10-04 02:57:17 -07:00
Matthew Meszaros
41d43f64be
feat: check that a verified root redirect actually reaches visitors by opening the domain over http and https and naming what answered instead (Traefik, nginx, Caddy, a rewritten Host header, a missing certificate, a closed port) with per-proxy fix steps in the sending domain drawer, and let a self-hosted instance linked to Warmbly Cloud have Cloud serve and certify its redirects (connect in place from the redirect tab, the bulk dialog or a page banner), with Cloud-side linked-instance redirect endpoints under a per-instance limit, migration 000237, labelled tracking answers and a 503 when the redirect lookup is unavailable, and the sending domains, Warmbly Cloud, data control, install, OpenAPI, API and error code docs updated
2026-09-30 06:04:00 -07:00
Matthew Meszaros
ca66b25d8d
feat: register the release's bus schemas from the booting backend and hold the fleet on its current release until the backend runs the new one and the schema registry accepts them, check every published schema against a recorded snapshot in CI (make schemas) so a change the registry would refuse fails before merge, pin a FORWARD or FULL registry subject to BACKWARD on refusal, bound advisor narration so the run still lands, store unlabelled 8-bit mail with its invalid UTF-8 replaced, treat a pending or credential-less passkey ceremony as a cancellation, and drop link-scanner rejections from site error tracking
2026-09-29 19:20:07 +02:00
Matthew Meszaros
4e68bb2562
feat: sell Warmbly to businesses only by requiring the buying company's legal name on the subscription and credit-pack Stripe Checkout sessions with a business-only and tax-exclusive notice beside the pay button, adding business-use and tax clauses to section 06 of the terms of service, and updating the billing guide to match
2026-09-27 11:10:46 +02:00
Matthew Meszaros
74bf081d57
feat: move the unibox Compose button from the top of the folder rail into the conversation list title row (and the Scheduled view header) as a ghost sky button with an N key hint on every viewport, keeping compose drafts at the top of the rail, and update the marketing inbox mock and the unibox guide to match
2026-09-24 20:53:37 -07:00
Matthew Meszaros
d8e99877b2
feat: let an update finish work in flight instead of cutting it off, by having the import runner stop claiming on shutdown, hand back rows that never started without counting the claim and finish the rows it is connecting on an uncancelled context, the backend wait up to 45 seconds for those rows and for in-flight connects, the event bus finish the message being handled before it stops reading, and node units, the repository compose file and the installer's stack allow 60 seconds before a forced stop, with the grace period documented for Railway, Docker and Kubernetes
2026-09-24 18:31:06 +02:00
Matthew Meszaros
d44fd38d90
feat: show the device and mail client behind every open and click (iPhone · Apple Mail app, Windows PC · Outlook app, Gmail · device hidden) from a new mailclient detector that recognises Gmail, Yahoo, Apple MPP, HEY, Fastmail and Seznam image proxies instead of reporting their fake browser and data-centre location, record app vs webmail and device_hidden on the open and click logs, backfill stored opens by the same rules, let the logs accept the scanner reason, and surface it on the contact timeline, a new How they read overview, the live campaign feed, recent activity, the campaign Device breakdown (surfaces), webhooks and realtime
2026-09-22 22:16:51 -07:00
Matthew Meszaros
0a5e7947b4
feat: return a failed warmup retention delete from the worker so the bus redelivers it up to five times, re-key a Graph message in the map on every move so the sender copy's body can be dropped, never expunge a whole IMAP folder for one message (UID EXPUNGE, else MOVE to Trash, else refuse), build the two retention indexes concurrently in their own migrations 000193 and 000194, keep the dashboard stepper off 1 and 2 days, and describe retention as applying wherever the placement files warmup mail
2026-09-21 01:11:22 -07:00
Matthew Meszaros
1513419a2a
feat: delete warmup mail from each mailbox once past a per-mailbox retention window (email_accounts.warmup_retention_days, else retention.warmup_mail_days, default 30) via a consumer sweep that retires the receipt and sender copy and a worker delete action that trashes on Gmail, deletes on Graph, expunges on IMAP and drops the stored body, prune per-message warmup records after retention.warmup_event_days, and count a warmup deletion as tampering only within 24 hours of arrival and never for a retired message, judging Gmail's Trash label on the same rule
2026-09-21 00:52:02 -07:00
Matthew Meszaros
742a173b51
Add steel Warmbly wordmark for theme-agnostic email signatures
2026-09-20 14:58:07 +02:00
Matthew Meszaros
876076942a
Add white Warmbly wordmark for dark-mode email signatures
2026-09-20 13:40:13 +02:00
Matthew Meszaros
56286f94e8
Add Warmbly wordmark for email signatures
2026-09-20 13:26:33 +02:00
Matthew Meszaros
06ccb9af38
feat: point every marketing-site call to action at a route the dashboard actually serves, rewriting app.warmbly.com/login and /register to /auth/login and /auth/register and the developers page's /settings/api-keys to /app/api-keys
2026-09-19 19:35:53 +02:00
Matthew Meszaros
758e83efe1
Merge pull request #614 from warmbly/remove-site-banner
...
feat: remove the site-wide launch banner from the marketing site
2026-09-19 17:01:08 +00:00
Matthew Meszaros
f0b15c2ddc
feat: remove the site-wide launch announcement banner from the marketing site layout and delete the LaunchBanner component
2026-09-19 10:00:01 -07:00
Matthew Meszaros
d855abfaa3
feat: replace the marketing site's Open Graph and Twitter card with a top-left 1.91:1 crop of the new dashboard export, and derive og:image type, width and height from the real image so blog covers stop declaring 1280x640 jpeg
2026-09-19 18:45:55 +02:00
Matthew Meszaros
464ec521ca
feat: present the $15 pool plan as the Warmup plan everywhere: rename the plan row (migration 000185), add it to the dashboard catalog so the header and billing overview name it, show the cloud tier in a self-hosted instance's header pill and a Plan section under Settings > Warmbly Cloud with upgrade and manage links to the cloud billing page, nudge on the mailboxes page only when the free pool is full, drop the self-host framing from the cloud's checkout dialog, paths panel and locked screen, rebuild the checkout dialog in the plan chooser's style, pitch Premium on deliverability from one shared benefit list, and update the billing and Warmbly Cloud guides and the pricing FAQ
2026-09-19 05:57:41 -07:00
Matthew Meszaros
d0857718c0
feat: restore the home page hero subheading about scaling B2B outreach and the first-paint hero mock scaling from PR #597 , which the CASA AL1 merge in PR #599 reverted by re-committing a stale copy of site/src/pages/index.astro
2026-09-19 04:58:49 -07:00
Matthew Meszaros
b09ec39907
Merge pull request #599 from warmbly/chore/casa-al1-security-assessment
...
feat: complete the ADA CASA AL1 control set and ship the assessment evidence pack
2026-09-19 06:39:12 +00:00
Matthew Meszaros
e668a2a36b
feat: complete the ADA CASA v2.1.1 AL1 control set across authentication, sessions, access control, cryptography, input validation and configuration, adding a breached-password denylist and per-account login throttling, enforced multi-factor authentication on the admin panel, step-up confirmation before an action that mints a lasting credential, purpose-scoped session tokens, single-use TOTP steps, tenant verification on every cross-referenced identifier, security headers on every surface, encrypted webhook signing secrets, per-organization idempotency, PKCE and a minimal two-scope Gmail consent on the mailbox OAuth flow, bounded spreadsheet and archive decoding, a patched Go toolchain with govulncheck in CI, and the evidence pack under compliance/casa
2026-09-19 08:18:35 +02:00
Matthew Meszaros
6428e6b3e9
Merge pull request #594 from warmbly/feature/disable-google-oauth-new-mailboxes
...
feat: route new Gmail mailboxes through a guided app-password connect instead of Google sign-in, behind BOX_GOOGLE_OAUTH_CONNECT, leaving existing OAuth mailboxes sending and re-authorizable
2026-09-19 06:11:15 +00:00
Matthew Meszaros
Devin AI
Matthew MeszarosandDevin AI
Matthew Meszaros