A platform product is not one of its own tenants
isOrgEntitledToApp exempted only the top-level org, so an org marked isPlatformProduct was billed as if it were a customer. sign.pink sits on a FREE_DEFAULT sub...
Enforce self-or-owner on an account, not just the org boundary
Follow-up to the cross-org gate, now that the rule is decided: inside an organization you may manage your own billing account, and an organization owner may man...
Stop one organization reaching another organization billing
/api/billing/accounts scopes its listing by the X-Org-Id header, but every route beneath /{accountUid} took the id straight from the path and never checked who ...
Split Available on the catalog verdict, and stop Stage publishing an app
The account Apps tab derived Available / Not Available from development stage, so it contradicted the platform catalog the moment an operator published or withh...
Only real entitlement roots get the platform app rows
Owning subscription plans was treated as proof of being an entitlement root. It is not: a customer org runs its own commerce markets and sells its own plans whi...
Answer "is this sellable" from the app catalog, not the enum
Availability became operator-editable at runtime, so deriving it from ServiceType.getStage() meant publishing MLOS in Apps and Features left it invisible on the...
Close four ways round the vertical and app gates
SecurityModelMarketController read and mutated security-model market attachments with no session check, no org scoping and no right — any caller could pass any ...
Load Allowed Apps from an endpoint tenants can actually read
appCatalogApi.list() is platform-owner-only, so on any tenant org the Branch Types editor showed no apps and the save guard — which exists to stop an empty cata...
Validate add-on codes before they can grant an app
active_addon_codes was written straight from the request body. That was harmless while nothing read the column, but it is now an authorization input: an add-on ...
Same alias NPE in the initializer seeders
resolveAll() has no entry for a deprecated alias sharing an id with a live app, so looping ServiceType.values() and dereferencing the result would have thrown m...
Stop a page load from persisting the entitlement projection
computeEffectiveFeatures added the caller's Hibernate-managed OrgFeature rows straight to its output and then flipped isActive on them. Its own javadoc calls th...
Stop iterating ServiceType.values() against the resolved catalog
resolveAll() omits the deprecated aliases that share an id with a live app (DOC_MANAGER/DOCS, AI_CHAT/AI_SUPPORT), because those have no catalog row of their ow...
Bind the rename cutover as a Timestamp, not a String
CockroachDB refuses <timestamp(6)> < <varchar> rather than casting, so the app-config repair threw on its first statement every boot: 'unsupported comparison op...
Repair the second name-persisted site of the LOS rename
**************** is @Enumerated(STRING) and holds RoleRightType names, so a default role granting mortgage stores "LOS_VIEW_PIPELINE". That is the third place t...
Point the mortgage surface back at the mortgage rights
Companion to the shared-library change. These 13 controllers all guard mortgage endpoints — HMDA LAR, pipeline, application intake, disclosures, credit orders, ...
Stop mortgage endpoints enforcing a personal-loan right
The LOS_* -> MLOS_* rename was applied to the enum declaration and nowhere else. Because the freed names were immediately re-declared as the personal-loan right...
Bound the LOS rename repair to rows that predate the rename
The repair matched on the string alone and ran on every boot, so it stopped being idempotent the moment anyone granted the personal-loan app: a row holding 'LOS...
Master model honours a runtime retirement; drop a dead guard
provisionMaxedOutMasterModel force-enables every app for the platform org, and that breadth is deliberate — pre-launch dogfooding is what the model is for. But ...
Two more places that answered "is this app offered" from the enum
Both were missed when FeatureController moved onto the app catalog, and both would have disagreed with it the moment an operator published an app. Organization...
Repair mortgage grants orphaned by the LOS to MLOS rename
ServiceType is persisted in two places and the 2026-08-08 rename only accounted for one. ORG_FEATURES.FEATURE_TYPE stores the numeric id, so keeping mortgage at...
Render Contact sales for add-ons with no list price
PageAddOn.price was typed number and built with Number(addon.pricePerUnit), so an add-on with no list price — the enterprise-negotiated origination systems — re...
Show negotiated pricing instead of $0.00 for enterprise-only add-ons
The origination add-ons carry no list price — they are negotiated per agreement — and formatCurrency(null) renders $0.00, advertising an enterprise module as fr...
Hide unreleased apps from the Plans & Billing catalog
**************** back the tab where a customer chooses what to subscribe to, so it must not offer a product still in the Not Available list — the same rule the ...
Never offer an unreleased app on a buying surface, bundles included
The stage filter only ran for the public marketing proxy. This endpoint also feeds the in-app SubscriptionOrderWizard, which is where a customer actually pays, ...
Keep the is-prefix on PlatformAccountSummary's wire names too
Same Lombok/Jackson hazard as PlatformOrgRow: isTopLevel() loses its `is` on serialization, so the DTO put `topLevel`/`platformProduct` on the wire while the fr...
Declare security matchers explicitly before the next build breaks startup
kamo-shared-library 1.5.0 was republished today with spring-ws-core as a new transitive dependency, so Spring Boot now auto-registers a second servlet (MessageD...
Keep the is-prefix on the wire for isTopLevel/isPlatformProduct
Lombok generates isTopLevel() for a `boolean isTopLevel` field and Jackson strips the `is` prefix, so the live endpoint was serializing `topLevel` and `platform...
Grandfather orgs already running a gated commerce market
Gating MORTGAGE behind MLOS made the gate unsatisfiable for tenants: MLOS is still PLANNING, and FeatureController.enable refuses a non-COMPLETED app for a chil...
Declare security matchers explicitly so the service can start
The service has not deployed since 2026-07-03; every pod since has crash-looped before the context loaded: This method cannot decide whether these patterns a...
Seed app entitlement for every root, and stop inventing plan tiers
Two defects found by checking prod before flipping kamo.entitlement.fail-open. Sign Pink is a second entitlement root (isPlatformProduct, with its own FREE/BUS...
Raise the Next body cap that was truncating every large upload
THE cause of the failing 3 GiB attachments, and it was ours, not the network. **************** was '500mb'. It is not a rewrite/middleware setting: Next wraps ...
Fail a dead upload in minutes instead of holding it for an hour
connectionUploadTimeout is the tolerated SILENCE between reads, not a budget for the whole transfer. Setting it to an hour to 'match Traefik' confused the two: ...
Stop a dead upload spinning forever, and say what 100% means
A stalled upload sat at 100% with the bar full and no way out. Three separate reasons, all of them mine. XMLHttpRequest has no useful read timeout: when bytes ...
Let an in-flight upload finish instead of dying on a rollout
A 2 GiB chat attachment reached 100% and then failed with 'Bad Gateway' because a deploy landed on top of it: the pod took SIGTERM at 03:34:36 and the transfer,...
Make a failed upload say what happened, and log enough to diagnose it
A 2 GiB attachment failed at the end of a four-minute transfer with 'Upload failed: upload failed Internal Server Error' — a doubled prefix wrapped around a mes...
Stop Tomcat's 60s connection timeout killing a long upload
A 2 GiB chat attachment failed after nearly four minutes of successful transfer with MultipartException wrapping a bare SocketTimeoutException, and the member w...
Apply custom status labels to the status tabs
Every other status display on /leads resolves its description through resolveLabel() from useStatusLabels — the grid cell renderers, both filter dropdowns, and ...
Stop the 60s entrypoint read timeout capping uploads
respondingTimeouts.readTimeout is the deadline for reading a WHOLE request, body included, and Traefik v3 defaults it to 60s where v2 had no limit. That silentl...
Stop the runtime theme sheet whitening the canvas on light-mode machines
DynamicMetaLoader appends theme.<domain>/css/globals.css to <head> after our own stylesheet, and that file still carries create-next-app boilerplate: :root{--ba...
Report user idle time so an abandoned tab can expire
The client activity tracker only ever gated whether we asked to extend; it never told the backend anything. SecurityService renewed the session TTL on every req...
Only slide the *** TTL when a human is actually there
getSession() refreshed the Redis TTL on every read, and OTKPreAuthFilter resolves the session before any controller runs — so every API call renewed the session...
Leave the individual out of a department signature too
A message sent from a department mailbox is written by the department: the reply lands there, not with whoever typed it, so signing it with a member's name and ...
Stop next/image breaking every proxied logo preview
The org branding screen **************** showed the full and simple logos as missing images even though the very same files render fine everywhere else in the a...
Pin the remaining hostPath workloads to the node holding their data
Same fault as embedding-model, found by auditing every hostPath volume in the repo. A hostPath is node-local and nothing replicates it, so an unpinned pod can b...
Sort departments alphabetically
The roster rendered department sections in whatever order the backend returned them. Sort the section keys A→Z (locale-aware); member order inside each section ...
Catch OptimisticLockException, the type 40001 actually wraps as
Round 3 review fix: hibernate-core's **************** tests LockAcquisitionException (what SQLState 40001 converts to) against four specific types in order, non...
Stop the first list row wearing a permanent focus ring
is but hide its ring until j/k is actually pressed; the first press just reveals it in place, and changing folders hides it again.
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.