Changelog

User-facing changes to qaitai. The marketing site renders this file at tryqaitai.com/changelog. Newest first. Versions follow the release tags (vX.Y.Z); nothing has been tagged yet, so everything below is unreleased.

Unreleased

September 2026

• Brand: Stark Swarm design on sign in, sign up and onboarding; the newest finding in a live run is marked with a single orange cell.
• Settings: members, API keys, browsers, domains, integrations, models and invoices pages on real workspace data.
• Cloud workers: each cloud run worker gets its own short-lived machine that is destroyed when it exits. Runs fail cleanly when a worker can't be dispatched.
• Security: self-hosted sign-up is invite-only by default; secrets are redacted from page URLs and overlapping values; fork pull requests no longer trigger suites; preview deployments only verify strict subdomains from trusted deployment bots.
• Local browser reuse: cookies and storage are wiped between runs on the local Steel browser.
• Evals: an eval harness for the agent, a small decision model for irreversible actions and finding triage, and browser adapters.
• Instance admins are an explicit role instead of being inferred per request.
• Email: SMTP and Resend transports, magic-link sign-in, workspace invitations, and a one-time admin sign-in link on a fresh self-hosted instance.
• Legal: draft Terms, Privacy Policy, DPA, subprocessor list, Acceptable Use and trademark policy; contributor license agreement workflow.
• Remote runners: runners inside your network need only a URL and a token, and make outbound HTTPS calls only. Usage records split cost into model, browser and infrastructure.
• CLI: npx qaitai run <url> "<prompt>" runs everything on your machine with your own model key; qaitai replay re-runs recorded actions without the model; qaitai doctor checks your setup. --path keeps workers inside part of your app.
• First version: control plane, runner, agent and database with row-level security, Docker Compose and Helm.