// CHANGELOG
every change.
DOCUMENTED.
A complete history of what we've shipped, changed, fixed, and secured.
v2.0.0
LATEST
February 1, 2025
ADDED
- Complete platform rewrite with improved architecture and performance
- API v2 with custom path-based routing and stricter input validation
- Dashboard redesign with BetterAuth dark theme and terminal aesthetic
- HWID device binding with configurable reset limits and anti-spoofing
- Encrypted file delivery system for licensed software distribution
- Subscription tier system with three plans (Basic, Premium, Ultra)
- Sub-account management with role-based access (Seller, Reseller, Manager)
- Bulk license generation supporting up to 10,000 keys per operation
- Real-time analytics dashboard with key metrics and usage trends
- Announcement system for customer-facing notifications
- Organization audit logs for compliance and security tracking
- Live chat support integration within the dashboard
CHANGED
- Migrated from MySQL to Supabase (PostgreSQL) for improved reliability
- Replaced framework dependencies with pure PHP implementation
- Upgraded encryption to AES-256 for all sensitive data and file delivery
- Improved API response times by 60% through persistent cURL handles
- Redesigned customer panel with per-app routing (/panel/{owner}/{appname})
FIXED
- Resolved session fixation vulnerability in legacy authentication flow
- Fixed race condition in concurrent key generation that produced duplicates
- Corrected timezone handling — all timestamps now stored as Unix integers in UTC
- Fixed pagination inconsistency in dashboard user listing for large datasets
SECURITY
- Implemented CSRF token generation and verification for all forms
- Added file-based rate limiting to prevent API abuse
- Enhanced IP detection with X-Forwarded-For and CF-Connecting-IP support
- Added security headers (X-Content-Type-Options, X-Frame-Options, X-XSS-Protection)
v1.5.0
January 10, 2024
ADDED
- HWID locking with hardware fingerprinting for license keys
- Webhook support for Discord and Telegram notifications
- Custom webhook endpoints for real-time event integration
- License key presets for reusable key generation templates
- Variable injection system for delivering encrypted app variables
- Blacklist system for blocking users, IPs, and HWIDs
- Downloadable license key exports (CSV and JSON formats)
CHANGED
- Improved key generation algorithm with better entropy distribution
- Optimized database queries reducing average API latency by 35%
- Enhanced dashboard navigation with sidebar and breadcrumb system
- Updated API v1 with additional error codes and descriptive messages
FIXED
- Fixed webhook delivery failures on slow endpoints (added retry with backoff)
- Resolved memory leak in long-running session management processes
- Corrected license expiry calculation for timezone-offset users
- Fixed CSV export encoding issues with special characters in usernames
SECURITY
- Patched XSS vulnerability in application name display
- Added input sanitization for all user-supplied string fields
- Implemented .htaccess rules to block direct access to sensitive files
v1.0.0
April 1, 2023
ADDED
- Initial public release of BetterAuth licensing platform
- REST API v1 with license validation, creation, and management endpoints
- Developer dashboard with application and license key management
- User management with registration, authentication, and ban controls
- License key generation with customizable formats and expiry settings
- Session management with token-based authentication
- Application-level secret keys for secure API communication
- Admin panel with system-wide controls and 2FA requirement
- Basic tier with free access (3 apps, 100 keys, 100 users)
SECURITY
- TOTP-based two-factor authentication for admin panel access
- Password hashing with bcrypt for all user accounts
- API key authentication for all external endpoints