What shipped

The subhead now repeats the promise word for word: the free check probes what your public anon (publishable) key can read and whether a service_role key is in your bundle — no account, GET, HEAD and OPTIONS requests only, under ten seconds, nothing stored. The instrument beside the form is a real table computed by the rule engine over RowShield's demo project (seven findings, health F), labelled as the connected nine-rule audit's view. New: a "Built with Lovable, Bolt, Cursor or v0? Start here." section with what the free check sees and does not see, three answers on the anon key, "nothing stored" and the request verbs, a pricing page, and a permission checkbox before a URL is probed.

The sample card with invented numbers is gone. In its place: the bundle x-ray, a real scan of keydrift.dev/demo-target — a page KeyDrift publishes so it can scan itself, carrying a deliberately planted service_role-shaped test key — with the lit line, the finding and a link to the stored report you can re-run. The chips under the form are the letter's words ("Free scan", "Ignores anon keys on purpose"), the button says "Scan for free", and the page says plainly that reports are kept at a private link so you can share them. Scanning a URL now asks you to confirm the app is yours to test; the front page ships about 30 KB less JavaScript.

The four detectors now carry one set of names everywhere — on the front page, in every audit result and in the dashboard: "Refund sent, fee kept", "Transfer never reversed", "Dispute fee never recovered", "FX rate gap at settlement". The hero says what the letter says — paste a Stripe Connect export, no credentials, read-only, 90 days back for free — and the illustrative monitor card is replaced by a reconciliation ledger built from the sample dataset, in which one kept fee resolves into a recovered row. A fee-leak calculator under the modelled example runs the arithmetic on your own numbers, with its one assumption stated.

All four sites now share one design system: the same tokens, type (Geist, with one italic-serif accent word per product headline), spacing, chips, buttons and footer. veristria.com leads with three evidence receipts — a real scan from each product, printed with the SHA-256 of the evidence file it links to, so "verify hash" means exactly that. Every site gained an imprint, a /.well-known/security.txt, and a cookie notice. Google Analytics loads on the production site without a consent prompt; the notice tells you it is there.

Each product now has a full handbook: KeyDrift's field manual on leaked secrets, RowShield's field guide to row-level security, and FeeGuard's ledger on Stripe Connect refunds. Every chapter is free to read, chaptered, and ungated — see /resources for the full shelf.

Sitemaps for all four sites — Veristria and the three products — have been submitted to Google. New pages, including today's handbooks and this changelog, are queued for crawling rather than waiting on discovery.

Roughly 75 long-form articles are scheduled across the family's blogs, with the first publishing today and the rest following on a daily schedule rather than all at once.

RowShield is live at rowshield.dev. Continuous row-level security testing and schema-drift detection for Supabase backends, with a free public audit that runs before you connect anything.

FeeGuard's pricing page is public and indexable: detection and the 90-day lookback stay free, monitoring is a flat monthly fee, and recovery carries a success fee on money actually clawed back.

KeyDrift, RowShield and FeeGuard can all now take a card at checkout. Each product's own pricing page has the current plans and terms.