Orchestrate the scan behind one cached, budgeted call
One response rather than three endpoints because it is one scan: the logo must be downloaded before its pixels can contribute a colour, and the colours are want...
Take hero imagery, falling back to carousel slides
The fallback is conditional by design. A site with a hero has already chosen one picture to represent itself; sweeping its carousel too would bury that choice i...
Reconcile brand colours from five independent sources
Five because each is authoritative on a different kind of site and silent on the rest: a design system states everything in CSS variables, a PWA in its manifest...
Find a site's logo from twelve independent signals
Twelve rather than one because there is no single place a logo lives. A Shopify store declares it in JSON-LD; WordPress puts it in a header img; a React app ren...
Index a site's CSS and parse its page once
A declaration scanner rather than a CSS grammar: the scan has three questions (custom properties, background images, colours) and none needs the cascade resolve...
Start the 3-day trial on first entry into the org, not at creation
Creating an org and opening it are different events. An org can be created and left sitting, and one nobody has walked into must not have spent its evaluation —...
Rank colours perceptually rather than by RGB frequency
Counting RGB values across a stylesheet elects the site's off-white page background every time -- it is the most-used colour on almost every site ever built. Wh...
Read real image dimensions from the bytes
Nothing here trusts the page. An HTML width attribute is a layout instruction, not a fact about the file -- a 2400px logo is routinely declared width="180" and ...
Ask for different work for a bug and an enhancement
A bug says 'find out why and fix it' and points at the logs; an enhancement says 'this already works, build the better version' and points at the current behavi...
Guarded outbound fetching for the website brand scan
The member types the URL, so every request this issues is an SSRF primitive, and there is no egress NetworkPolicy and no forward proxy in this cluster -- Redis ...
Remind the dispatched session to push its work
A session that fixes a bug and leaves the change sitting on the dev machine has not fixed anything anybody else can see. The sentence is split out of the entit...
Start the 3-day trial when the org is created
The trial was seeded pending and started on the owner's first sign-in, because an org was unreachable until its DNS verified — starting the clock at creation wo...
Internal probe endpoint so the access canary tests the real path
The KamoDesktop canary needs a link minted the way the icon mints one. It holds the same signing key, so it could build its own — and would then be testing itse...
Answer whether a web alias is still free
The org-creation wizard is eleven steps long and the alias was only checked when the form was submitted, so someone who picked a name another organization alrea...
Send To AI, gated on MANAGE_SYSTEM_BUGS
The class carries @RequirePlatformRight, so the interceptor resolves the caller and refuses before any handler runs — a per-method check would have been one for...
Turn the workspace picker on
A member of several organizations now chooses which one to open after their password, instead of it being chosen for them by the hostname. This is the switch th...
Turn the workspace picker on
A member of several organizations now chooses which one to open after their password, instead of having it chosen for them by the hostname. This is the switch t...
Accept an explicit org, not only the host
Registration bound the account to whatever organization the host resolved to. On register.kamocrm.com — the signup page for every organization with no register ...
Refuse the AI training corpus exports for PHI tenants
ANALYTICS_EXPORT is blocked because exports leave the boundary with no de-identification. Both training exports already had a fail-closed audit — there IS a rec...
Send the tree on the app-catalog endpoint too
Branch Types → Allowed Apps builds its editor from /features/app-catalog, not from the tenant features listing, so it was the one surface that could not see whi...
Serve an org's branding to a screen with no session
Login, registration and the meeting lobby paint an organization's colours before any session exists. They knew which one from the hostname, which is exactly wha...
Serve the app tree, and fix the unguarded auto-enable
FeatureController now sends parent/children/isParent on every serialized app so the client can render children nested under their parent. Served rather than mir...
Entitlement-check every vertical, not just the gated two
Every CommerceType now names its own child app under POS, so the isGated() short-circuit that waved retail, rentals, service, subscriptions and procurement stra...
Let the shell fetch its org from the session, not the host
kamo-internal's root layout reads the Host header, strips "internal." and fetches /org/domain/<that>. On a host serving one tenant that is the same question as ...
Let a member sign in without a host naming their org
Adds the second half of the split: a sign-in that names no organization authenticates the user, then asks which workspace. POST /api/security/session/select tur...
Frame and media endpoints, and seed the new rights
Self only, and enforced in the QUERY. Every read and write resolves the member from the session and every repository call takes that id, including the single-fr...
Seed the mail and lead widgets, and add a universal seed for the timecard one
The mail and lead widgets follow their data rights exactly as the calendar ones do — ACCESS_MAIL and VIEW_LEADS — so a holder gains no data they could not alrea...
Seed the calendar widgets to everyone who can already read the calendar
Both widgets show a member exactly what /calendar already shows them, so a calendar reader gains no data they could not reach — which is what makes this a safe ...
Annotate the member roster with its chat policy verdict
SecurityService serves the roster the chat UI is built from, so it has to answer with the same verdicts MediaService enforces with -- one shared evaluator, or t...
Ask EmailService to back-fill a lead's past e-mail
Implements the shared library's LeadEmailBackfillTrigger, so ticking "Associate Past E-Mails w/ Lead" on a lead save reaches the only service that can read mail...
Accept a reservation raised for another agent
POST **************** now honours onBehalfOfMemberId, gated on EDIT_OPPORTUNITIES — the right that gates managing opportunities on the reserved list, and alread...
Publish Hibernate statement counts to Prometheus
/actuator/prometheus already carried jdbc_* and hikaricp_* but no hibernate_*, because Spring Boot 3 only auto-configures those metrics when **************** is...
Return each member's accepted-today count per product
Manage-Credits shows Max Daily Spend but nothing about how much of it is used, so a manager could not tell whether a member was one lead from their cap or had n...
Mint a System User session for a support agent's open ticket
enter-as gains a second reason to say yes. SystemUserEntryPolicy turns the caller's *** into the facts the shared SupportSystemAccessResolver takes, and that re...
Map companyName so a spreadsheet can carry the business name
setDirectFieldOnCreateRequest had no companyName case, so the field was unreachable from the manual-import wizard even though CreateLeadRequest carries it and L...
Accept the discount* signup fields, keep the mrt* ones working
The register site now sends discountVisitorGuid / discountCode. Both names are read, new first, because the two services deploy independently — for the minutes ...
Publish signup and org-created for tracked visitors
The register site now forwards the marketing visitor GUID and tracking code in the request body — not a header, because the proxy strips Cookie and the ingress ...
Enforce is_fake, and close the holes that let an unattended signup in
Two halves of one incident. An account registered, verified an address at a disposable provider, took an auto-login session and created five organizations in th...
Let a member give up their own membership
The network page has offered "Unsubscribe" since it was written. It opened a confirmation dialog and then said the feature would be implemented soon, because th...
Per-member SSO credentials and a preflight that explains failures
Linux is gated on an enabled provision rather than god, and served with the member's own credentials. The connection is omitted from the token entirely when the...
Dev machine service and controllers
Username derives from the member ACCOUNT email, not the TeamMember work email — a work address can sit on another domain and would silently produce a different ...
HTTP client for the dev machine provisioning agent
health() swallows transport failures and answers false so the SSO preflight can return an actionable 503 rather than a 500.
AES-GCM secret codec and POSIX username derivation
Codec is deliberately reversible — RDP auto-login needs a real password — and uses GCM so a tampered or wrong-key row fails loudly rather than decrypting to noi...
Send int64 ids to the browser as strings, without touching sessions
CockroachDB unique_rowid() ids are 19 digits, past Number.MAX_SAFE_INTEGER, so an id sent as a JSON number arrives in the browser with its low digits rounded aw...
Resolve the KamoMeet logo overlay into config.json
KamoMeet is a Meet fork with no access to OrgContext, so it learns org branding from the theme config.json this service bakes. The org stores an overlay TOKEN; ...
Narrow the member search to holders of a given right
The lead assignment picker needs the directory to return only people who can actually work a lead, so /team-members/search takes a requiredRight. An unrecognise...
Let the creator choose the new org's apps
The network-create wizard gains an Apps & Features step, and this is the half that makes it real. /branch-types/creatable now describes the apps each branch ty...
Protect god accounts on the platform administrator list
A god account's platform rights may be changed only by another god, and a god account can never be removed from the list — by anyone, including another god. Go...
Bake the org's background order into config.json
kamo-login, kamo-register, the marketing site and KamoMeet all read the theme bucket's config.json for backgroundImageCount; backgroundOrder now rides alongside...
All-networks follows the System User right
Seeing every organization and being able to enter one are the same decision — the list exists so an operator can find the organization they are about to support...
Like what you see shipping?
Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.