Changelog
What shipped, when, and why it matters.
- Security
Hardening pass across auth, AI, and the leaderboard
Fixed a SQL-injection vector in leaderboard ranking (moved to parameterized queries), switched refresh-token storage to SHA-256 hashes instead of raw values, added JTI-based access-token revocation for instant logout, closed a race condition in daily AI-credit enforcement with atomic Redis increments, and added a prompt-injection guard in front of every AI endpoint. Full write-up in our audit report.
- Feature
Multi-model AI tutor via OpenRouter
Replaced our single-model AI setup with a 7-model catalogue routed through OpenRouter — GPT-4o and GPT-4o mini, DeepSeek R1 and Chat v3, Qwen3 Coder, and Gemma 3. Each feature (hints, error explanations, code review, mock interviews) is now matched to the model best suited for it, with per-model token ceilings enforced automatically.
- Feature
Real code execution, certificates, and a public playground
Lessons now run your code in an isolated sandbox with a 5-second CPU budget and no network access — no more regex string-matching. Completing 100% of a track now auto-issues a publicly verifiable certificate. Also shipped: in-app notifications, global search across lessons and community posts, and a playground for saving and sharing standalone code snippets.
- Feature
Email verification and password reset
Added the full account-recovery loop: verification email on signup, a resend option, and a self-serve forgot/reset password flow that revokes all active sessions on completion.
- Feature
Admin content management system
Full CRUD for tracks, modules, lessons, and interview questions, plus project-submission review with AI-assisted scoring and community moderation tools — all gated behind role-based access control.
- Feature
DevCraft launches
Frontend and Backend Engineering tracks, an AI tutor for hints and code review, community Q&A, a weekly/monthly/all-time leaderboard, and a 200+ question interview-prep bank — all free to start.