Product

Changelog.

What we shipped, fixed, and hardened — newest first.

title: Changelog description: What changed recently in Floatless.

Changelog

What we shipped, fixed, and hardened — newest first. This page starts with the current launch-readiness hardening pass; expect regular entries once the product is publicly available.

2026-09 — Launch-readiness hardening

Security & tenant isolation

  • Tenant isolation on AI insights: customer health insights and retention offers are now strictly organization-scoped — a customer of one tenant is indistinguishable from a missing one on another tenant's AI endpoints.
  • SSO nonce verification: OIDC ID tokens are now checked against the sign-in state's nonce, closing the token-replay window on Google SSO.
  • DNS-rebinding defense for webhooks: delivery connections are pinned to the exact IPs that SSRF validation resolved, so a webhook domain cannot re-resolve to an internal address at dial time.
  • Webhook receiver probing closed: unknown and unconfigured organizations now return the same response on Stripe webhook URLs, removing an organization-enumeration oracle.
  • Audit redaction everywhere: the manual audit path now applies the same secret-denylist as the automatic one, and live portal links are no longer written into audit records.

Billing reliability

  • Dunning is multi-instance safe: the daily collections run takes a database-level claim, so two schedulers can never double-send dunning emails.
  • Scheduler heartbeat: background jobs (renewals, dunning, webhook delivery) write a liveness beat every 30 seconds; a stale heartbeat fails the health check and alerts operations — a dead scheduler can no longer go unnoticed.
  • Wallet monthly caps serialized: concurrent spends can no longer jointly exceed a wallet's monthly spend cap.

AI cost & resilience controls

  • Every LLM client now has a 30-second timeout and bounded retries (the provider default was 10 minutes).
  • Streaming assistant responses are capped in length.
  • Per-user, per-organization, and per-customer hourly quotas (database-backed, effective across workers) on every endpoint that spends provider tokens — including the customer-facing invoice explanations, which were previously unmetered.
  • A documented global kill switch (LLM_API_KEY) disables all AI features safely during a provider incident.

Platform

  • JSON structured logs in production, with request IDs on every line.
  • Sentry wired for backend and frontend with release tagging.
  • French legal surfaces: Terms of Service, Privacy Policy, and the Data Processing Agreement are now available in French (Conditions, Confidentialité, ATD); the English versions remain authoritative.
  • Console trilingual coverage: the core money flows — orders, subscriptions, billing runs, wallets, payments, dunning, invoices, customers, and settings — are fully internationalized in English, French, and Spanish.
  • CI now runs on every working branch and enforces a coverage floor.

2026-09 (earlier) — AI capability rollout

  • Buoy, the console billing assistant: asks questions of your own billing data in plain language, proposes changes, and executes them only after explicit confirmation with role checks.
  • Portal assistant: customers can ask about their own invoices, payments, and balances in the self-service portal — strictly scoped to their own data, with no ability to change anything.
  • Smart dunning: collection emails are tuned per customer with strict anti-hallucination checks on amounts and facts.
  • Revenue NL: natural-language questions answered through a fixed set of read-only, tenant-scoped tools — never by generating SQL.
  • Usage anomaly detection: flags metered usage spikes before they land on an invoice.