The platform had been authenticating with a shared API key, which is a single secret that every copy of the app carries and that identifies nobody. It moved to per-user tokens: requests now say who is making them, which is the precondition for every ownership check, every rate limit that counts against a person, and every piece of moderation that came later.
A set of features that existed in the app but had nothing behind them got their endpoints — announcements, reviews, polls and the Pocket vault. Post details were filled out with the contributor and group information the screen had been rendering blanks for, and like, view and comment tracking was upgraded to record which contributor did it rather than only how many.
On the infrastructure side the build moved to esbuild, taking a production build to under a second, and the S3 bucket region was corrected — a wrong region does not fail loudly, it returns a redirect that silently renders nothing.
This release also brought a real-time chat system with end-to-end encryption. It was removed later in the year: it was a second product inside the first, and the encryption in particular was a promise we were not in a position to keep well.
Everything in this release
- Improved
Authentication moved from a shared API key to per-user tokens.
A shared key identifies nobody, which makes ownership checks and per-person limits impossible.
- Added
Endpoints for announcements, reviews, polls and the Pocket vault.
- Improved
Likes, views and comments record which contributor, not just how many.
- Fixed
The S3 bucket region was corrected.
A wrong region returns a redirect rather than an error, so images simply render as nothing.
- Improved
Production builds moved to esbuild and dropped to under a second.
- Added
A real-time chat system, since removed.