What's new

July 8, 2026

Any signed-in user could previously read another attorney’s email, phone, and iCal token straight off their profile. The iCal token doubled as the key to that attorney’s public calendar feed, so this amounted to a case-data harvest. Both now live in owner/admin-only tables and are no longer readable by other users.

Previously only claiming a request required an admin-verified bar credential; posting one needed just an account. Both sides now hold to the same standard.

Signup now has the same SMS opt-in checkbox and consent language previously available only in Settings, so carrier and TCPA opt-in is verifiable before you ever log in.

Uploading a bar card, insurance certificate, or background check now alerts every admin right away instead of waiting for someone to check the queue.

A dead permission check let a user set their own account to admin; found live, fixed in the two places it existed. Also fixes a gap that let an uninvolved user post a review on someone else’s hearing, and one that blocked a firm owner from reading their own firm.

June 16, 2026

Connect onboarding failures now return the actual Stripe error message and log to Sentry, instead of a generic 500. Found during live-mode Connect activation testing.

June 14, 2026

Adds a render layer at /blog and /blog/[slug] that pulls posts from a WordPress REST API. Shows a "coming soon" state until an operator connects a WordPress instance — no WordPress site is live yet.

Corrects overstated verification and outcome language on /attorneys-in/[slug] flagged in an ethics review. Copy now matches what the platform actually attests to.

Adds /court-coverage/arizona plus 101 individual city pages, each built from real court data with jurisdiction-specific stats and non-testimonial copy. Extends the SEO surface beyond the existing attorneys-in metro pages.

A new rls-integration GitHub Actions job runs the RLS policy suite against the test Supabase project on every pull request. Conditional on three repo secrets being present (test DB URL + service-role key). Keeps RLS regressions from reaching main.

The RLS test harness at src/lib/rls.integration.test.ts now executes against a provisioned test Supabase project instead of skipping. Four policy assertions confirmed passing: app_config deny-all for authenticated users, cross-user dispute block, cross-user request_documents block, and cross-user coverage request read block.

Court directory pages now guard null city/county values before rendering and carry a corrected SEO title. Migration 091 adds a 25 MB size limit and MIME allowlist to the request-documents storage bucket. The admin refund route now calls writeAuditLog(). 69 Playwright stress specs added under e2e/stress/ covering the court directory.

June 13, 2026

Action gates on the coverage detail page (claim, confirm, cancel, complete) now route through the tested predicates in coverage-lifecycle.ts instead of duplicated inline conditions. Behavior is unchanged; correctness is now enforced by the existing predicate test suite.

Adds a per-IP rate limit on /api/auth/verify-email. Admin user-export CSV now strips credential columns (hashed_password, totp_secret, backup_codes) from the download. DarkModeScript inlines theme preference via JSON.stringify rather than direct string interpolation, closing a stored-XSS vector.

apply-migration.mjs now accepts a test target alongside prod and staging. apply-all-migrations.mjs runs the full migration sequence against a target in one command — intended for spinning up a fresh test database.

Migration 090 adds RLS DELETE policies on reviews and messages for admin moderation routes and tightens referral_events INSERT to the authenticated user only. Adds rate limits on /api/push/subscribe and /api/user/export-data. Admin health page now masks the Twilio account number in the status display. RLS integration test harness added (skips until a dedicated test Supabase project is provisioned).

Rate limits added to /api/stripe/payment, /api/stripe/transfer, /api/stripe/refund, and /api/admin/export. Admin export now calls writeAuditLog() on every download. iCal feed migrated to the canonical createServiceClient() helper. 81 critical-path tests added, bringing the suite to 292 tests across 24-25 files.

Migration 089 hardens the handle_new_user trigger so a failed profile insert is logged to a new signup_errors table rather than surfacing a 500 to the user. Also canonicalizes app_config RLS so only service-role can read/write it — closing a gap where authenticated users could read internal config keys.

Migration 088 drops two prod-only permissive RLS policies on disputes and request_documents that allowed any authenticated user to file a dispute or attach documents to any coverage request, not just their own. All access is now correctly scoped to the parties on the coverage request.

Attorneys must now attest to limited-scope-representation client consent before a coverage request is accepted — satisfying the TCPA/ABA Model Rules disclosure requirement at the point of posting. Landing and privacy pages corrected per the ethics review: removed a false AI-anonymization claim and overstated bar-verification language.

Replaces the prior landing page with a legal-broadsheet editorial aesthetic — Fraunces serif display type paired with Hanken Grotesk, a new neutral palette, and a restructured above-the-fold layout.

June 12, 2026

Closes the OAuth 2FA bypass from the 2026-06-09 audit: /auth/callback now withholds session cookies for TOTP-enrolled accounts and routes through a new /api/auth/oauth-totp challenge before issuing a session. Deletes the orphaned /api/referrals/attach and /api/stripe/subscription routes (dead code from PRs #197 and #199 with no rate limiting). Consolidates five inline service-role client constructions onto the canonical createServiceClient() helper so future hardening applies everywhere.

You can now only claim a coverage request once an admin has verified your bar credential, and the conflict-check step asks you to attest that you are licensed in the court’s state. Closes a UPL / Rule 5.5 gap and makes the "bar-verified attorneys" promise literally true.

Your billing page now shows money held in escrow (charged but not yet released), not just settled payouts — so both sides can see pending funds. A new Completed Hearings tab collects every finished appearance in one place.

A standalone Pay button now lets you complete payment on a confirmed request from its detail page or the list — useful if a payment didn’t go through the first time.

Fixed a bug where releasing payment to the covering attorney could fail, leaving a completed hearing unpaid. Payouts now transfer reliably on completion.

SMS notifications are off by default and require you to turn them on in Settings, where the consent terms (message frequency, rates, STOP/HELP) are shown. Brings SMS in line with TCPA and carrier (A2P 10DLC) requirements.

A conversation now shows the attorney you’re talking to on top, with the case name and number on a smaller line below — case details stay hidden until identity is revealed.

Corrected several marketing and product copy strings flagged by an ABA Model Rules review (including overstated verification language), and error/success toasts now use the CoverageCobra brand colors.

May 9, 2026

Enforces conflict checks on claim_coverage_request (previously bypassable). Adds a master ai_features_enabled kill-switch across all /api/ai/* routes. Service worker now blocks caching of authenticated pages and guards notification-click to same-origin URLs only; deploy-hash cache busting replaces the manual version-string bump. Adds messages.sender_id index and a max_offered_rate_cents cap. GitHub CI workflow added (required status check, branch protection enforced). Closed 11 deferred UI stress findings: 3 modal Esc handlers, 5 dark-mode component fixes, global :focus-visible rule, time grid responsive fix, sidebar auto-close on route change. GitHub repo moved to CoverageCobraAZ org. Migrations 064, 065, 067 applied to staging and production. Migration 066 (SMS trigger CRON_SECRET via custom GUC) remains deferred pending Supabase Vault availability.

Closes 8 of 9 findings from the 2026-05-09 security sweep: admin payout compare-and-swap, credentials bucket server-side constraints, two RLS policy gaps (migration 065), SMS fanout migrated to CRON_SECRET, subscription double-billing guard, Sentry beforeSend log noise removed, JSON-LD escape helper applied to public attorney and court pages. Sentry is now verified working in production for both captureMessage and unhandled-throw paths. Migration 066 (SMS DB trigger migrated to CRON_SECRET via custom GUC) is deferred — Supabase hosted blocks ALTER DATABASE for custom GUC parameters; revisit with Supabase Vault post-launch.

May 8, 2026

Closes the Critical / High findings from the 2026-05-08 launch-readiness audit: tightened email + SMS send routes against phishing abuse, moved the service-role key out of the database, added Stripe idempotency keys to checkout/Connect/subscription flows, capped firm bulk-import row counts, MIME-validated audio uploads to AI transcribe, added audit-log entries on admin credential views, locked down the avatars storage bucket, and patched the high-severity axios CVE.

May 4, 2026

Inquiry threads now refresh in real time as messages come in — no more page reloads. The requester is notified when an attorney inquires, and the inquirer is notified when the requester replies.

May 3, 2026

Dashboard stats and onboarding checks now use Postgres estimated counts instead of full COUNT(*) scans, eliminating the 503s some users hit on first page load.

May 2, 2026

A regression caused the coverage browse page to fire 100+ Supabase queries per page load. Fixed the dependency stability bug in useCoverageRequests so the page now does exactly one fetch per filter change.

May 1, 2026

Some attorneys were being unexpectedly signed out when navigating between pages. The middleware now preserves Supabase session cookies on redirect responses, and AuthContext + the in-app links no longer force full reloads that re-armed the auto-signout flag.

April 30, 2026

Closed the Critical and High issues found during the first internal tester walkthrough — including hardened cookie handling, fixed signup edge cases, and addressed several null-safety crashes on coverage detail pages.

April 17, 2026

Subscribe from Settings → Notifications or the in-app prompt. Get instant alerts for new coverage requests, claims, and messages — even when CoverageCobra is closed. Works on Chrome, Edge, Firefox, and iOS 16.4+ Safari.

New /forgot-password and /reset-password pages so users can recover their accounts. New users are walked through a 3-step profile wizard (basic info → practice areas → rate & bio) the first time they sign in.

April 16, 2026

New Settings tab in /admin lets admins tune platform fee, auto-match radius, min hourly rate, referral credit, and toggle welcome drips, SMS, AI features, signups, and maintenance mode — all without a redeploy. A site-wide amber banner appears when maintenance mode is on.

Four new admin capabilities: SMS template preview + send-test (Twilio), manual Stripe payout button for stuck transfers, a rich per-user detail page at /admin/users/[id], and a reports moderation queue for users flagging each other.

Any attorney profile now has a "Report" button. File a report with a category (spam, harassment, fraud, no-show, etc.) — admins see it in their moderation queue and can resolve or dismiss with notes.

Admins can now preview every notification email template (welcome drips, request updates, payments, firm invitations) with a live iframe preview and send a test to their own inbox before anything goes to real users.

Once an admin verifies your bar number, malpractice insurance, or background check, a green "Verified" badge shows on your public profile, internal profile page, and search results. Expired credentials show an amber warning so you know to re-upload.

Admins can now review uploaded bar cards, insurance certificates, and background checks with one-click verify or remove. Verified insurance + background-check uploads automatically flip the attorney’s trust flags.

Admins can now verify all integration env vars (Stripe, Resend, Twilio, Anthropic) at a glance, see a 30-day growth chart for signups / requests / completed / revenue, and promote/demote admins or suspend users inline.

If your request has been sitting without a claim, one click escalates it to urgent priority. Covering attorneys in your area get notified immediately.

Download a 19-column CSV of your year’s completed hearings from /hearings or the tax report — receipt URLs included. Ready for Excel, your CPA, or reimbursement workflows.

A new dashboard card surfaces up to 5 open urgent/high-priority requests that match your practice areas. Never miss an opportunity.

The notifications dropdown now has filter tabs — All / Unread / Messages / Requests / Payments — with per-tab counts. Triage faster.

Hit Cmd+K (or Ctrl+K on Windows) from any page to fuzzy-search across every section and quick action. Navigation at your fingertips.

A smart status pill in the top bar shows whether you are checked in, broadcasting availability, or offline — one click to toggle.

Shipped a full sitemap.xml + robots.txt so Google can now discover public attorney profiles, city landing pages, and the court directory.

For repeat cases, click "Duplicate Request" on any completed hearing. The form prefills everything except the date — just pick a new time and post.

Clicking "Use" on a case template now prefills the new coverage request form with your saved defaults. Previously a silent no-op.

Any hearings happening today surface at the top of the dashboard with a live countdown, directions to court, and one-click check-in.

New dashboard cards show your 12-month earnings trend and the five courts where you earn the most. Instant feedback on how the platform’s working for you.

Every completed coverage request now has a receipt at /receipts/[id] — logo, parties, hearing details, itemized charges, Stripe reference. Ctrl+P to save as PDF.

Generate an AI-written recap of your last 7 days — coverages completed, earnings, upcoming hearings, and one concrete next step.

Shipped the final shield logo across the app, refined the dark mode theme, and added a one-click toggle in the sidebar.

Sign up with a `?ref=` link and we now automatically credit the referrer when you complete your first hearing — plus a clear how-it-works panel on the referrals page.

Shipped 17 fixes: timing-safe auth comparisons, XSS-safe email templates, query hardening against RLS edge cases, and stuck-loading guards across ~15 data hooks.