Support

Rebuild changelog

The previous version of Kivo47 published a page listing its own defects and then shipped anyway. This is that list, with what happened to each one.

Issues found

Fixed in this rebuild

Still open

Needs a real backend

Settings saved nothing

Settings

critical

The API keys section had a Save button that was wired to no handler. Values vanished on reload with no error, so it read as a bug in the browser rather than a missing feature.

Fixed. Every control in Settings now writes through the store and persists. Nothing renders a button that does not do something.

404 page broke the theme

Routing

minor

The app was dark, the not-found page was light grey. Hitting a bad link felt like landing on a different site.

Fixed. A single themed not-found page that follows light and dark like every other route.

Affiliate banner in the workspace header

Layout

major

A promotional banner sat above the workspace on every page, pushing the actual content down and competing with the primary action.

Fixed. Removed. The workspace header now carries navigation and the plan's own progress, nothing else.

Lists had no empty states

Global

major

A new account saw blank panels with no explanation and no way forward, which is indistinguishable from a failed load.

Fixed. Every list has an empty state with a one-line explanation and a primary action.

Duplicate meta description on every route

SEO

major

All fifteen routes shared one description string, so search results and link previews were identical regardless of the page.

Fixed. Per-route titles and descriptions, with Open Graph metadata generated from the same source.

Focus states were invisible

Accessibility

critical

Outlines were suppressed globally, which made the app effectively unusable with a keyboard.

Fixed. A visible focus ring on every interactive element, in both themes, never removed.

Horizontal scroll below 400px

Responsive

major

Wide tables and the cost breakdown pushed the page body sideways on small phones.

Fixed. Wide content scrolls inside its own container. The page body never scrolls horizontally.

No server-side rate limit on the AI endpoint

Backend

critical

Anyone holding a session could call generation in a loop. This is a billing incident waiting to happen rather than a bug report.

Fixed. Closed. Every endpoint that spends money is now capped per caller per hour, counted atomically in Postgres so one limit holds across every server instance at once. Signed-in callers are identified by account id, everyone else by client IP. Generation is five an hour.

Webhook signatures unverified

Payments

critical

Payment events were trusted without checking the signature, so a forged request could grant a paid tier.

Fixed. Closed with the payment integration. Every webhook delivery is checked against PayPal's verify-webhook-signature endpoint before it is acted on; a forged POST is refused with a 401 rather than granting a tier.

Support

Rebuild changelog

The previous version of Kivo47 published a page listing its own defects and then shipped anyway. This is that list, with what happened to each one.

Issues found

Fixed in this rebuild

Still open

Needs a real backend

Settings saved nothing

Settings

critical

The API keys section had a Save button that was wired to no handler. Values vanished on reload with no error, so it read as a bug in the browser rather than a missing feature.

Fixed. Every control in Settings now writes through the store and persists. Nothing renders a button that does not do something.

404 page broke the theme

Routing

minor

The app was dark, the not-found page was light grey. Hitting a bad link felt like landing on a different site.

Fixed. A single themed not-found page that follows light and dark like every other route.

Affiliate banner in the workspace header

Layout

major

A promotional banner sat above the workspace on every page, pushing the actual content down and competing with the primary action.

Fixed. Removed. The workspace header now carries navigation and the plan's own progress, nothing else.

Lists had no empty states

Global

major

A new account saw blank panels with no explanation and no way forward, which is indistinguishable from a failed load.

Fixed. Every list has an empty state with a one-line explanation and a primary action.

Duplicate meta description on every route

SEO

major

All fifteen routes shared one description string, so search results and link previews were identical regardless of the page.

Fixed. Per-route titles and descriptions, with Open Graph metadata generated from the same source.

Focus states were invisible

Accessibility

critical

Outlines were suppressed globally, which made the app effectively unusable with a keyboard.

Fixed. A visible focus ring on every interactive element, in both themes, never removed.

Horizontal scroll below 400px

Responsive

major

Wide tables and the cost breakdown pushed the page body sideways on small phones.

Fixed. Wide content scrolls inside its own container. The page body never scrolls horizontally.

No server-side rate limit on the AI endpoint

Backend

critical

Anyone holding a session could call generation in a loop. This is a billing incident waiting to happen rather than a bug report.

Webhook signatures unverified

Payments

critical

Payment events were trusted without checking the signature, so a forged request could grant a paid tier.