Changelog

The initial public beta. Brings the desktop app, marketing site, portal, and NLP service together under one signed-installer / public-signup launch.

Added

Desktop app

• Support for four NoSQL databases: MongoDB, Redis, Firestore, and DynamoDB — including local query execution, automatic schema sampling, and translation.
• First-run onboarding wizard: install → API key → first MongoDB connection. Skippable for advanced users; localStorage flag persists the completion state per machine.
• Plan + usage badge in the chrome with five distinct states (loading, no key, portal unreachable, unlimited, quota'd). Refreshes every five minutes and on window focus.
• Global keyboard shortcuts: ⌘/Ctrl+Enter to submit a prompt, ⌘/Ctrl+, to open API-key settings, ⌘/Ctrl+Shift+H to return home.
• Settings → Privacy page with a single opt-in toggle for anonymous usage telemetry. Off by default; queued events are dropped immediately when turning the toggle off.
• macOS keychain / Windows Credential Manager / libsecret integration (via optional keytar) for storing the locally-resident API key. Falls back to an encrypted file in userData when the OS keychain isn't available. Banner explains which backend is in use.
• Crash-recovery modal when the sidecar exits unexpectedly: surfaces logs from userData/logs/ and offers a one-click restart instead of silently quitting the app.
• React ErrorBoundary at the App root with a self-contained fallback card; errors are forwarded to Sentry (when configured).
• Auto-update check banner. Auto-update install is deferred until beta.2.

Portal

• Public marketing site: hero, pricing, docs (getting started, connecting MongoDB, API reference, privacy model), live-demo widget, status page.
• Legal pages: Privacy, Terms, Cookies, About, Contact. Marked as pre-launch placeholders pending counsel review.
• Cookie banner with explicit accept/reject and persistent storage. Optional analytics stay off until the user opts in.
• Dashboard: account overview, API keys (list / generate / revoke), usage chart + CSV export, billing (Paddle customer-portal link + invoice history), team (invite / remove / seat resize), and settings (data export + account delete).
• GDPR data export feature returning a JSON bundle of profile, API key metadata, usage records, and team membership.
• Account soft-delete with a 30-day grace window before permanent deletion.
• Public status page at /status for real-time uptime monitoring with per-component latency display.
• Transactional emails for welcome, payment failure, and subscription cancellation.

NLP engine

• Per-API-key sliding-window rate limit with standard rate-limiting HTTP headers.
• Strict CORS policies enforced on all API endpoints.

NLP router

• Dedicated API gateway that securely routes and authenticates all incoming NLP requests.
• Pre-authentication IP-based rate limiting to protect service stability.

Cross-cutting

• Comprehensive error tracking with automated PII (Personally Identifiable Information) scrubbing to ensure sensitive data (like prompts, connection URIs, and API keys) never leaves your environment.
• Strict security headers (CSP, HSTS) implemented across all web properties.
• Rate limiting applied to authentication and API usage to prevent abuse.

Security

• API keys are stored hashed (SHA-256). Plain-text is shown exactly once on creation and never persisted.
• Magic-link sign-in tokens expire after 15 minutes; sign-in attempts are rate-limited.
• Sidecar refuses to start when its key vault can't be unlocked, rather than silently downgrading to plaintext.