Changelog

2026-07-13

• Pricing Unified credit pricing across every product: Free (500 credits/mo), Starter $19 (5,000), Pro $59 (18,000), Business $199 (60,000), Enterprise from $999 (250,000+) — one credit balance, prepaid top-up packs, and every competitive claim on the site recomputed against it.
• Homepage Rebuilt the homepage around the full 6-product catalog (CapchaID, Consent/Lead, CapchaSign, CapchaVerify, CapchaShield, Banking/ISO 20022) plus a platform-services strip; the CapchaVerify product page shipped; roadmap.html rewritten to match portfolio reality; sitemap completed.
• Trust Shipped the public chain explorer (/explorer.html): live chain status, a block-by-block explorer, OTS anchor + Merkle-inclusion verification, the published signing key, a one-click record verifier, and the offline-verify how-to — wired into the homepage services strip and sitemap.
• SDK Published @capchacloud/sdk — a typed TypeScript client for the public API (ESM + CJS + type defs, live-smoke-tested against production, v0.1.0).
• Docs OpenAPI now documents CapchaID auth (22 endpoints) and CapchaSign (34 endpoints): full set lives in the CI-gated openapi.yaml; a curated public subset ships as openapi.json so /api-reference.html renders cleanly. Fixed /api-reference.html rendering blank in production (Redoc's CDN script was CSP-blocked; now vendored locally).
• Honesty CapchaVerify's native (non-vendor) screening path for CapchaSign was overstating what it actually checked — fixed to report only what really ran. The live demo's "production fingerprint" badge previously stayed green even when the response was tampered with; it now correctly flips on tamper. Fixed the CC-GATE demo hitting an already-expired purpose credential.
• Security Added rate limits to CRITICAL/HIGH-severity POST endpoints that had none; hardened transport at the edge (http→https and www→apex redirects, HSTS header).
• CI Added capcha-shield and trust-dashboard jobs to CI and made workflows fire on harden/** branches; fixed a CI-blocking worker crash (excluded the node-only verifier spec from the Workers test pool), a stale pnpm lockfile, a pre-existing tsc error blocking capcha-mcp's first CI run, and a console-lint false-positive on co-located test files.
• Site polish Sitewide Docs-nav parity fix, comparison-page footer cross-links, and OG-tag gaps closed across the marketing site.

2026-07-11

• CapchaShield Shipped KYC/AML with bring-your-own vendor credentials: tenants can supply their own compliance-vendor keys per check, with a same-origin proxy in trust-engine and a BYO vendor credential vault in CapchaShield. Made the whole product discoverable — product-page CTAs, a live demo panel, homepage links — plus a Sumsub webhook handler and rate limiting, and synced the dashboard's new Verification (KYC/AML) section.
• Trust Threaded real Merkle-inclusion proofs into the evidence verify/bundle surfaces (previously a stub); surfaced previously-hidden capabilities on the public site — Integrate nav, product links, the offline evidence-bundle download, the consent wallet, and the auth-evidence doc.
• Comparisons Added the vs-docusign.html comparison page and cross-linked all three (vs-Clerk, vs-DocuSign, vs-TrustedForm).
• CapchaMCP embedSnippet now pins to the frozen /v1/widget.js URL contract; shipped tenant/org/billing/wallet MCP tools with an honesty-parity pass and a live-probe script.
• Demo Consolidated three separate demo pages into one unified /demo page; added the versioned, frozen /v1/widget.js URL contract (Stripe.js-style pinning, so integrations don't break under us).
• Reliability Added a Cloudflare-native dead-letter-queue backstop for lead webhooks so failed deliveries aren't silently lost.
• Design Unified the marketing / trust / legal page theme sitewide onto one design system.
• Adversarial audits Ran structured adversarial audits against CapchaSign (4 real gaps found and fixed) and the lead-capture → webhook-delivery path (3 real gaps found and fixed) — plus a real-DOM deploy gate and portfolio embed-presence canary for the embed widget.
• CI Excluded co-located src/*.test.ts from the standalone tsc pass, unblocking the predeploy gate.