Release history.

• Security: Fixed SoQL injection vulnerability in ENERGY STAR search
• Security: Fixed supply chain IDOR — added ownership verification
• Quality: Converted all 47 inline auth checks to router-level middleware
• Quality: Added AppError class hierarchy and asyncHandler for centralized error handling
• Quality: Added server-side product search (GET /api/products/my?q=&category=&status=)
• Quality: Added 5 missing CRUD endpoints
• Cleanup: Extracted role group constants, renamed service files to PascalCase, moved 7 components to correct feature module directories, fixed 22 catch(error: any) blocks to catch(error: unknown)

• Admin sidebar consolidated: 11 items → 6 (Operations, Planning groups)
• Admin dashboard rebuilt as operations hub: stat cards (users, products, paid), product status overrides
• SEO tasks merged into Todo as a "SEO" category (33 tasks migrated)
• Removed: Analytics (empty), Tech (redundant), SEO page (merged) — ~3,700 lines of static JSX eliminated

• New /admin/users page — accounts, activity, engagement analytics
• Login tracking: lastLoginAt, loginCount, lastLoginIp columns; session-based (> 30min since last)
• User detail sheet: profile, engagement stats (logins/week, account age), usage metrics, subscription toggle

• New Certificate Vault page — 27 certification types across 6 categories (organic, GFSI, UL, FCC, REACH, Fair Trade, etc.)
• ENERGY STAR API integration — verify products against 1.8M certified models across 47 categories
• Certificates integrated into Compliance Alerts — expiring certs alongside CPC, Prop 65, PFAS, documents

• New Todo page (/todo) — micro-level task tracker with step-by-step guides, priority levels
• Rebuilt Concepts page — 4 tabs: Strategic, SEO Pages, Integrations, UX Mockups
• Cross-linking: Todo ↔ Roadmap ↔ Concepts ↔ Changelog

• Audited all 79 pending code review todos
• Marked 61 complete (47 resolved + 4 obsolete + 10 partial)
• 18 genuine items remain pending

• Fixed STRIPE_SECRET_KEY using publishable key; fixed empty SESSION_SECRET
• Fixed mass assignment vulnerability in PUT /api/vendors (field allowlist)
• Auth middleware now fails closed; system routes require admin authentication
• Startup env validation — hard fails if STRIPE_SECRET_KEY has pk_ prefix
• Code splitting with React.lazy() — 12 route components lazy-loaded

• Replaced module switcher with industry-driven sidebar (Food vs. Consumer Goods)
• CPSIA, Prop 65, PFAS visible as nav items for consumer-goods users

• 3-step PFAS questionnaire wizard (assessment → components → regulations)
• Dynamic PFAS component entry (substance, concentration, function)
• 8-state regulation database (CA, ME, NY, WA, MN, VT, CO, MD)
• PFAS disclosure report PDF generation

• Yes / No / Not Sure chemical assessment flow
• 15 pre-populated chemicals with CAS numbers and hazard types
• Short-form and long-form warning label generation
• Label preview in packaging and shelf-tag sizes; PDF generation

• CPC 7-field data entry form (CPSIA Section 14(a))
• Pre-populated CPSC safety standards (ASTM F963, etc.)
• CPC PDF certificate generation via pdf-lib
• Lab test document linking; CPC status tracking (draft → issued → superseded)

• Extended products table with compliance_modules, product_type, intended_age_group
• Added cpc_certificates, prop65_disclosures, pfas_disclosures tables
• Dev-bypass login (no Supabase required for local work)
• Marketing site: 5 pages at alephco.io

Rebranded from FSVP Pro to Aleph.

• React 18 + TypeScript + Vite frontend
• Express + PostgreSQL + Drizzle ORM backend
• Supabase Auth + Stripe billing (3 tiers: monthly, semi-annual, annual)
• FSVP compliance module: products, documents, FDA registration, connections