All deployments
Peter Theill
deployed a security update
2 days ago
Peter Theill
deployed a performance improvement
2 days ago
Peter Theill
deployed a documentation update
2 days ago
Peter Theill
deployed a documentation update
3 days ago
Peter Theill
deployed a documentation update
3 days ago
Peter Theill
deployed a feature
3 days ago
Peter Theill
deployed a documentation update
3 days ago
Peter Theill
deployed a security update
3 days ago
3 days ago
ποΈ Blocks hold on the website too; reports only reach what the reporter can see
rule lives in the model (Donation#open_to?, a Comment validation), so any
future path is covered as well.
the owner, so they can't be used to find out that a draft exists.
- The web comment form and "ask for this item" now honour blocks, and the
rule lives in the model (Donation#open_to?, a Comment validation), so any
future path is covered as well.
- The web comment controller hides drafts like the donation page does.
- Reports of a draft listing, or of a comment on one, 404 for anyone but
the owner, so they can't be used to find out that a draft exists.
Peter Theill
deployed a documentation update
3 days ago
3 days ago
:shield: Report, block, filter and terms for user content; new privacy policy and terms; OpenStreetMap tiles
What App Review guideline 1.2 asks of an app with user content:
support straight away.
are hidden, their requests are withdrawn, and they can no longer ask for
or comment on the blocker's things.
descriptions and comments, in all seven languages.
post, comment or ask for things.
The privacy policy now names every service that handles data (Hetzner,
Resend, OpenAI for photo suggestions, the sign-in providers), how long data
is kept and how to delete an account; the terms state zero tolerance for
objectionable content and how reports are handled. Both are now in all
seven languages instead of English only.
Maps use OpenStreetMap's tiles, with the attribution they require, instead
of Carto.
- Reports of listings, comments and people (POST /api/reports), emailed to
support straight away.
- Blocks (/api/blocks): a blocked person's listings, comments and activity
are hidden, their requests are withdrawn, and they can no longer ask for
or comment on the blocker's things.
- A whole-word filter (config/content_filter.yml) on listing titles,
descriptions and comments, in all seven languages.
- App users must accept the terms (POST /api/me/accept_terms) before they
post, comment or ask for things.
The privacy policy now names every service that handles data (Hetzner,
Resend, OpenAI for photo suggestions, the sign-in providers), how long data
is kept and how to delete an account; the terms state zero tolerance for
objectionable content and how reports are handled. Both are now in all
seven languages instead of English only.
Maps use OpenStreetMap's tiles, with the attribution they require, instead
of Carto.
Peter Theill
deployed a performance improvement
4 days ago
Peter Theill
deployed a configuration change
4 days ago
Peter Theill
deployed a feature
4 days ago
4 days ago
π Answer the API in the asker's language, photo suggestions too
/mcp, and the iPhone app's tokens only on /api.
only gives to the app named in the new apple-app-site-association, instead
of a custom URL scheme any app could claim.
email, since emails here are not verified.β¨ JSON API for the new iPhone app
The API skipped localized routes and so always spoke the default language:
errors, activity messages and notification text reached a Danish iPhone in
English. It now follows Accept-Language. Photo suggestions (title and
description) are written in the request's language as well, on the web
form too.
ποΈ Scope API tokens, use an https sign in callback, never link Apple sign in by emailerrors, activity messages and notification text reached a Danish iPhone in
English. It now follows Accept-Language. Photo suggestions (title and
description) are written in the request's language as well, on the web
form too.
- ApiTokens get a scope: mcp tokens (made on the settings page) only work on
/mcp, and the iPhone app's tokens only on /api.
- The website hand-off redirects to https://<host>/app/callback, which iOS
only gives to the app named in the new apple-app-site-association, instead
of a custom URL scheme any app could claim.
- Sign in with Apple no longer signs in to an existing account with the same
email, since emails here are not verified.
Bearer token auth on /api with the existing ApiTokens, Sign in with Apple
(POST /api/session/apple), and a website hand-off at /app/authorize so every
existing way of signing in works in the app without it handling passwords.
Adds posting with a photo, editing and deleting, requesting, approving and
rejecting, regions, charities filtered by currency, notifications, and the
account (including deleting it, which App Review requires).
(POST /api/session/apple), and a website hand-off at /app/authorize so every
existing way of signing in works in the app without it handling passwords.
Adds posting with a photo, editing and deleting, requesting, approving and
rejecting, regions, charities filtered by currency, notifications, and the
account (including deleting it, which App Review requires).
Peter Theill
deployed a bug fix
4 days ago
4 days ago
π Return real image URLs from the JSON API and stop leaking internal fields
The API serialised donations with as_json, so image_url came back as the
Active Storage attachment (with the whole record nested inside) instead of
a URL, and every column was exposed - requesters, unsubscribers, transfer,
transaction_id, and a comment's payment details.
Responses are now built field by field, with image_url, thumbnail_url,
charity logo_url and user avatar_url as URLs. Drafts 404 through the API
for anyone but their owner, matching the web page.
β¨ Double down on SEO and AEOActive Storage attachment (with the whole record nested inside) instead of
a URL, and every column was exposed - requesters, unsubscribers, transfer,
transaction_id, and a comment's payment details.
Responses are now built field by field, with image_url, thumbnail_url,
charity logo_url and user avatar_url as URLs. Drafts 404 through the API
for anyone but their owner, matching the web page.
Structured data on every public page (Organization sitewide, Product,
NGO, Place, ProfilePage, CollectionPage, Article, BreadcrumbList),
robots directives with noindex on personal and search-result pages,
a sitewide RSS feed, image entries in the sitemap, and llms.txt /
llms-full.txt rendered from the database instead of static files.
Translate the SEO category landing pages and giving guides into
Swedish, Norwegian, German, French and Spanish, and move the guides'
hardcoded badges and calls to action into locale keys.
NGO, Place, ProfilePage, CollectionPage, Article, BreadcrumbList),
robots directives with noindex on personal and search-result pages,
a sitewide RSS feed, image entries in the sitemap, and llms.txt /
llms-full.txt rendered from the database instead of static files.
Translate the SEO category landing pages and giving guides into
Swedish, Norwegian, German, French and Spanish, and move the guides'
hardcoded badges and calls to action into locale keys.
Peter Theill
deployed a documentation update
4 days ago
Peter Theill
deployed a feature
7 days ago
Peter Theill
deployed a feature
8 days ago
8 days ago
Merge pull request #71 from theill/api-v1-documents
Add JSON upload API for native clients
β¨ Add JSON upload API for native clients
POST /api/v1/documents creates a document from a multipart file (or
files[]) and returns its view_url, edit_url and expires_at. Files over
100 MB go through POST /api/v1/direct_uploads, a CSRF-free mirror of
Active Storage's direct uploads, and are attached by signed_ids[].
The controllers inherit from ActionController::API, answer errors as
JSON and are rate limited per IP. Documented in README and llms.txt.
β¨ Add JSON upload API for native clients
POST /api/v1/documents creates a document from a multipart file (or
files[]) and returns its view_url, edit_url and expires_at. Files over
100 MB go through POST /api/v1/direct_uploads, a CSRF-free mirror of
Active Storage's direct uploads, and are attached by signed_ids[].
The controllers inherit from ActionController::API, answer errors as
JSON and are rate limited per IP. Documented in README and llms.txt.
8 days ago
β¨ Add a create-label dropdown with a chat option
β¨ Add photo labels and image AI to Settings > Media
β¨ Add skills tab to place and event types
β¨ Chat with the label specialist on Labels
β¨ Choose when agent tools are loaded
β¨ Configure forms shown by assistants
β¨ Create via chat from a place or supplier as defaults
β¨ Give every list the same Add menu with create via chat
β¨ Hide added skills in the library by default
β¨ Move agent tools and outputs to their own tabs
β¨ Open the supplier dashboard as the supplier
β¨ Reset system agents and skills from settings
β¨ Show agent outputs and tools as list-style tabs with status views
β¨ Show photo labels in the lightbox and edit chat photo results
β¨ Show system agent instructions read-only next to Ekstra instruktioner
β¨ Show the GuideDanmark upscale when approving
β¨ Show which types a skill is used on
π Keep "all matching" when a row is deselected
π Keep skill library groups from clipping cards
π Offer accept on single-record deletions and call them deleted
π Open supplier trip drawer in supplier dashboard
π Open the add label menu under its button
π Put each output and tool in one status view
π Send create defaults with the chat message
π Show GraphQL errors without a stack trace outside development
π Type the dashboard hook spec's mock like the other specs
10 days ago
β¨ Choose which watched fields run immediately
β¨ Limit watched fields to the values that matter
β¨ Run automations on the current entity
β¨ Set KΓΈr straks on each watched field
β¨ Show GuideDanmark sync on the publication card
β¨ Show sending state for segment messages
β¨ Show the sites an agent searched as favicon chips
π Allow adding a price with only a name
π Disable adding a price without a name
π Require an amount or free for a price
π Show failed GuideDanmark publication
12 days ago
β¨ Add automation library
β¨ Fold the plan into the work once the answer streams
β¨ Name a search's single result and show suppliers readable tool details
β¨ Replace chat fast mode with a model picker
β¨ Reset library automations instead of generating metadata
π Close library modals on overlay click
π Hide focus ring on the drawer return-focus target
π Keep closed linked automation drawers closed
π Keep failed lookups from calling entities deleted
π List every locale a run reads
π Open every linked chat entity in place
π Open skills from chat in a drawer
π Steady proposal cards and label batches by run