Changelog

September 27, 2026: README wording

• The README now says the 13,000+ figure counts people who used the source apps, not LaunchSaaS customers.

September 25, 2026: Project docs

• Added DECISIONS, FRAGILE and SECURITY documents to the repository, so you can see why the code is the way it is before you change it.

September 24, 2026: Stripe guest checkout fix

• payments-stripe: a one-time guest checkout no longer clears a subscriber's stored Stripe customer id, which made their later subscription events fail. If you use payments-stripe, redeploy the webhook.

September 24, 2026: Bug sweep and runtime test coverage

A full review fixed about 60 bugs across the packages. Several were security bugs, and some were features that could not have worked as shipped. If you copied a package before this date, follow the upgrade checklist in the repository.

• Payments: Stripe webhooks now verify signatures with the async API, so they work on Deno and Edge runtimes (they rejected every signed event there before). Unpaid or canceled subscriptions now lose premium access, a one-time purchase no longer replaces a subscription plan, and failed updates return an error so Stripe retries them.
• Security: users can no longer raise their own plan through a database function or by writing to the tier tables, and team invitations can no longer be sent to yourself for any workspace. Sanitizers now catch nested and multi-line script tags.
• Multi-tenancy: an invitee can no longer accept an invitation as owner, accepting invitations works under row-level security, and the team-members policies no longer recurse.
• Auth (NextAuth): role and tier checks no longer deny everyone, and first-time OAuth and magic-link users no longer land on a 404.
• Error handling: a chunk that stays missing after a deploy no longer reloads the page forever.
• New test suites in CI, on every push: the SQL on Postgres 16, a real local Supabase stack, both Stripe webhooks with locally signed events, the rate limiters on Redis, strict type-checking against real dependencies, React components, Chromium and WebKit, touch gestures, and Next.js password, magic-link and OAuth sign-in.

January 31, 2026: First release

• 13 packages extracted from our production SaaS apps: auth and payments, database and multi-tenancy, API patterns, file uploads, security, error handling, testing, DevOps, performance, frontend components, notifications, Python OAuth and JWT, and the patterns library.