All deployments
Peter Theill
deployed a refactoring
17 days ago
Peter Theill
deployed a feature
19 days ago
Peter Theill
deployed a styling change
19 days ago
Peter Theill
deployed a dependency update
19 days ago
Peter Theill
deployed a feature
19 days ago
Peter Theill
deployed a styling change
19 days ago
Peter Theill
deployed a bug fix
20 days ago
20 days ago
🐛 Press assets: handle non-variable logos (SVG/ICO) instead of 500ing📱 Mobile-friendly navigation and package header♻️ Restructure footer into Product/Company/Legal; drop Commanigy and dead dark footer🐛 Center link icon inside hero URL field💬 Update site title and meta description to package-first copy🐛 Fix package cards overflowing page width with grid-cols-1
Peter Theill
deployed a feature
20 days ago
20 days ago
🔥 Remove usage-count stats and placeholder-pricing note
gated by Plan#webmcp? with server-side package-limit enforcement
get-package, create-package) on <body> for entitled signed-in users
:moneybag: Restructure plans: free extension, Maker caps at 5, Pro → Shipaholic
semi-automated via the extension, and the copy now says so
Too few users for the numbers to help: drop the footer stat boxes,
"launched this week" counter, About's "By the Numbers", and the
"thousands of makers" claims. Directory catalog counts stay.
✨ WebMCP: in-page agent tools to read and create launch packages"launched this week" counter, About's "By the Numbers", and the
"thousands of makers" claims. Directory catalog counts stay.
- /webmcp JSON endpoints (list, show, create) using session auth + CSRF,
gated by Plan#webmcp? with server-side package-limit enforcement
- Stimulus controller registers navigator.modelContext tools (list-packages,
get-package, create-package) on <body> for entitled signed-in users
- create runs the same WebScrapingJob enrichment as the web flow
- Chrome extension is now included on every plan, Free included
- Maker drops from unlimited to 5 packages; Shipaholic keeps unlimited
- Pro renamed to Shipaholic (display only — :pro key stays for Stripe/enum)
- Drop all "automated submissions" claims and credits; the assisted flow is
semi-automated via the extension, and the copy now says so
- New webmcp entitlement flag on Maker and Shipaholic
Peter Theill
deployed a documentation update
20 days ago
Peter Theill
deployed a bug fix
20 days ago
20 days ago
🐛 Fix 500 following the password-reset redirect; SMTP via 587
a redirect with a turbo_stream Accept header — serve the HTML template
default) to 587 with STARTTLS; the reset mail job was dying with
Net::OpenTimeout
- sessions#new rendered a nonexistent new.turbo_stream when Turbo followed
a redirect with a turbo_stream Accept header — serve the HTML template
- Resend SMTP moves from port 465 (Hetzner blocks outbound 25/465 by
default) to 587 with STARTTLS; the reset mail job was dying with
Net::OpenTimeout
Peter Theill
deployed a feature
20 days ago
Peter Theill
deployed a bug fix
20 days ago
Peter Theill
deployed a refactoring
20 days ago
Peter Theill
deployed a security update
20 days ago
20 days ago
🔒️ Live Stripe only in production
With live keys now in the shared credentials file, configured? became true
in development and test — checkout/cancel/mode gate on live_mode?
(production, or explicit STRIPE_LIVE=1) so local runs and the test suite
always simulate. Caught when a test stubbing production hit live Stripe.
in development and test — checkout/cancel/mode gate on live_mode?
(production, or explicit STRIPE_LIVE=1) so local runs and the test suite
always simulate. Caught when a test stubbing production hit live Stripe.
Peter Theill
deployed a refactoring
20 days ago
Peter Theill
deployed a refactoring
20 days ago
Peter Theill
deployed a documentation update
20 days ago
Peter Theill
deployed a feature
20 days ago
20 days ago
✨ Press assets page + rubocop fix
(the upvote/bookmark/hot-ranking product they described is gone), styled
to the monochrome direction
the four docs it linked no longer existed
(name + project + status was public), keeping the page as a sales asset🔥 Purge the directory-era product-discovery stack
AutoDiscoveryJob and SourceCrawlJob (WebScrapingJob stays — /launch uses
it for enrichment)
upvote/bookmark helper methods
in production) with idempotent directory CSV import + launch package
seeds only🔊 Add Sentry error tracking (inactive until a DSN is configured)🔧 Align Ruby to 3.4.7 everywhere, fix onboarding landing spots
tested on .ruby-version (3.4.7) — all three now agree
back to the just-created package🔒️ Close the pre-launch security gaps
only, and no hosts resolving to private/loopback/link-local space
creation, and the metadata endpoint (sessions already had one)
script hosts, and frame_ancestors none
stored unencrypted, only fed the paused automation tier
docker builds — note: it remains in git history🔒️ Gate the extension API behind per-user tokens
credential (a Resend API key); delivery errors now raise so failures
surface instead of silently defaulting to localhost:25
commanigy.com leftover
Remaining manual steps: create the mail.launchto.win sending domain in
Resend, add its DNS records, and put the API key in credentials as
smtp.password.🔒️ Make billing production-safe: add stripe gem, refuse simulated checkout in production
(stripe.secret_key, webhook_secret, prices.maker/pro) are added
free when Stripe is unconfigured in production
(webhook payloads omit them)
subscription deleted, payment failed🔒️ Enforce plan limits server-side
was reachable past the hidden dashboard button)
automation_enabled honored only for plans with auto_submit
flag + plan check, and no longer defaults to checked
not on every attempt
🚑️ Stop hourly AutoDiscoveryJob, fix admin 500 and dead links, add admin:promote task
ownerless projects from crawled sources (and exposing them via the API)
Stats now shows directory submission count
💄 Freemium pricing display, pricing-fields UX, form field class normalization
packages#assets now renders a download grid (logo in every directory size,
screenshots) with the JSON manifest still available — the Maker feature is
visible instead of a bare JSON endpoint.
📝 Rewrite the pre-pivot copy — about, help, README; strip public submission feedscreenshots) with the JSON manifest still available — the Maker feature is
visible instead of a bare JSON endpoint.
- About and help pages now tell the package-once-launch-everywhere story
(the upvote/bookmark/hot-ranking product they described is gone), styled
to the monochrome direction
- README rewritten as the launch pitch + accurate dev/production setup;
the four docs it linked no longer existed
- /directories/:slug no longer lists other users' recent submissions
(name + project + status was public), keeping the page as a sales asset
- Delete the 11 crawlers, orchestrator, ProductSource model, its admin UI,
AutoDiscoveryJob and SourceCrawlJob (WebScrapingJob stays — /launch uses
it for enrichment)
- Drop the product_sources table
- Remove empty bookmarks/comments/upvotes helpers and the orphaned
upvote/bookmark helper methods
- Replace the 241-line demo seeds (sample users with password123 — harmful
in production) with idempotent directory CSV import + launch package
seeds only
- Dockerfile built 3.4.2 and the deploy workflow pinned 3.3.9 while CI
tested on .ruby-version (3.4.7) — all three now agree
- New signups land on /launch instead of the marketing homepage
- The unauthenticated /launch fallback stores a return-to so sign-in leads
back to the just-created package
- SSRF guard (SafeUrl) on metadata scraping and favicon downloads: http(s)
only, and no hosts resolving to private/loopback/link-local space
- Rate limits on sign_up, password resets, unauthenticated project
creation, and the metadata endpoint (sessions already had one)
- Enforced Content-Security-Policy with per-request script nonces, pinned
script hosts, and frame_ancestors none
- Drop users.hn_username / hn_password_encrypted: no UI ever wrote them,
stored unencrypted, only fed the paused automation tier
- Untrack data.dump (a production pg_dump!) and ignore *.dump in git and
docker builds — note: it remains in git history
Implements the recommended call from the launch plan: /api/packages/:slug,
/api/directories/lookup and /api/directories/map now require
Authorization: Bearer <api_token> from a plan with extension access, and
packages/mappings are scoped to the caller's own projects — packages are no
longer publicly enumerable and the Maker tier's headline feature is actually
gated.
401/403 messages; stale subdomain copy removed
source (was a stale hand-made 1.6.0); rebuilt at 1.7.0
:email: Wire production SMTP through Resend and fix the from-address/api/directories/lookup and /api/directories/map now require
Authorization: Bearer <api_token> from a plan with extension access, and
packages/mappings are scoped to the caller's own projects — packages are no
longer publicly enumerable and the Maker tier's headline feature is actually
gated.
- users.api_token (has_secure_token) + lazy backfill via User#api_token!
- Token shown on /extension when signed in with extension access
- Extension v1.7.0: token setting in ⚙, Bearer header on API calls, clear
401/403 messages; stale subdomain copy removed
- rake extension:build regenerates public/launch-to-win-extension.zip from
source (was a stale hand-made 1.6.0); rebuilt at 1.7.0
- production.rb delivers via smtp.resend.com:465 using the smtp.password
credential (a Resend API key); delivery errors now raise so failures
surface instead of silently defaulting to localhost:25
- From-address is Launch to Win <hello@mail.launchto.win> instead of the
commanigy.com leftover
Remaining manual steps: create the mail.launchto.win sending domain in
Resend, add its DNS records, and put the API key in credentials as
smtp.password.
- gem 'stripe' so live mode can actually engage once credentials
(stripe.secret_key, webhook_secret, prices.maker/pro) are added
- PaymentsService raises NotConfiguredError instead of granting plans for
free when Stripe is unconfigured in production
- detect_plan re-fetches the checkout session with line_items expanded
(webhook payloads omit them)
- Webhook lifecycle tests: activation from metadata, price-id fallback,
subscription deleted, payment failed
- ProjectsController new/create check can_create_package? (the /launch form
was reachable past the hidden dashboard button)
- Directory submissions: free-tier directory_copy_limit enforced per project;
automation_enabled honored only for plans with auto_submit
- retry_automation requires can_auto_submit?
- Automation toggle hidden behind the (off) directory_submissions_enabled
flag + plan check, and no longer defaults to checked
- DirectorySubmissionJob emails failure once after retries are exhausted,
not on every attempt
- Fix ensure_owner redirects that pointed at the removed GET project route
- Tests for the new enforcement paths
- Remove the hourly production AutoDiscoveryJob schedule that was creating
ownerless projects from crawled sources (and exposing them via the API)
- admin/projects index no longer calls the removed bookmarks_count column;
Stats now shows directory submission count
- Admin 'view' links point at the package (project_path only routes DELETE)
- bin/rails admin:promote EMAIL=... mints the first real admin
Also save docs/road-to-prime-time.html — the launch-readiness plan.
Peter Theill
deployed a styling change
20 days ago