# Changelog

All notable changes to Autheona are documented here. We follow semantic versioning and maintain transparency about updates to the platform and API.

## How to Read This Changelog

- **Added**: New features and capabilities
- **Changed**: Changes to existing functionality
- **Fixed**: Bug fixes and corrections
- **Improved**: Performance and usability enhancements
- **Security**: Security-related updates

## Stay Updated

- Check this page regularly for updates
- Subscribe to our newsletter for major releases

## Version History

<details>
  <summary>v1.0.0 - 15, July 2026</summary>

**Platform Redesign and Policy Engine Launch**

Complete platform rebuild based on customer feedback following MVP release.

**Added**

Platform:

- New dashboard with redesigned design system
- IF-THEN configurable policy engine (replaces linear rule engine)
- Custom references for user-defined value checks
- ARM 64 architecture support

**Changed**

- Migrated from Intel 64-bit to ARM 64-bit architecture
- Replaced linear rule engine with AST-based policy engine

</details>

---

> [!NOTE]
> The following entries reflect updates from the initial version of the Autheona platform. Please note that since the release of the first version, the entire application and its APIs have been rewritten from scratch to better align with user requirements.
>
> As a result, some features or behaviors described in this section may no longer exist in the current system and are provided here for historical reference only.
>
> Any documentation, endpoints, or configuration methods listed in this historical changelog that are not reflected in the current platform documentation should be considered deprecated or removed.

<details>
  <summary>v1.6.0 - 30, April 2026</summary>

**Velocity Tracking and Enhanced Response Structure**

**Added**

Trust Verification API:

- Velocity tracking for multiple account detection from same IP
- `has_multiple_emails_in_ip` response field indicating multiple accounts from same IP
- `emails_in_ip` array in `analyzed_data` showing complete validation history per IP
- Time-based velocity counters in `analyzed_data`:
  - `emails_in_ip_last_5_minutes` - Validations in last 5 minutes
  - `emails_in_ip_last_10_minutes` - Validations in last 10 minutes
  - `emails_in_ip_last_15_minutes` - Validations in last 15 minutes
  - `emails_in_ip_last_30_minutes` - Validations in last 30 minutes
  - `emails_in_ip_last_2_hour` - Validations in last 2 hours
  - `emails_in_ip_last_3_hour` - Validations in last 3 hours
  - `total_email_in_ip` - Total validations from IP across entire project
- New validation step: `ip_duplication` for velocity tracking
- New checked type: `multiple_emails_in_ip` for velocity checks
- New risk breakdown signal: `high_velocity` for rapid account creation patterns

Project Rules:

- **Track Velocity** rule category
- **Multiple Accounts from the Same IP Address** rule for detecting account creation abuse

Documentation:

- New **Checked Types** section documenting all validation type indicators
- Complete velocity tracking example with response structure
- Updated best practices for velocity monitoring

**Changed**

Trust Verification API:

- `action` field now always returned
- Removed specific "blocked" error codes:
  - `free_provider_domain_blocked`
  - `role_based_address_blocked`
  - `disposable_domain_blocked`
  - `known_abuse_domain_blocked`
  - `spam_trap_domain_blocked`
  - `not_educational_domain`
  - `not_government_domain`
- Provider and classification rules now contribute to risk scoring and action determination instead of direct blocking

Project Rules:

- Renamed rule category: **Provider & Account Classification**
- Rule behavior changed from blocking to checking:
  - **Free Provider Domain** (formerly "Block Free Provider Domains")
  - **Role-based Domain** (formerly "Block Role-based Addresses")
  - **Disposable Domain** (formerly "Block Disposable Domains")
  - **Known Abuse Domain** (formerly "Block Known Abuse Domains")
  - **Spam Trap Domain** (formerly "Block Spam Trap Domains")
  - **Educational Domain** (formerly "Educational Domains Only")
  - **Government Domain** (formerly "Government Domains Only")
- Rules now perform checks that contribute to risk scores and actions
- Only `not_in_specific_domains` error remains for specific domain restrictions

**Improved**

- More flexible validation logic based on risk assessment rather than hard blocking
- Better fraud detection through velocity tracking across time windows
- Enhanced account creation abuse detection
- Automated bot attack identification
- Bulk registration fraud prevention
- Action-based responses provide clearer guidance on handling validations
- Classification flags provide explicit detection results
- Time-windowed velocity analysis for burst pattern detection

**Use Cases**

- Detect account creation abuse from same IP address
- Identify automated bot registration attacks
- Prevent fraudulent bulk account creation
- Monitor velocity patterns across multiple time windows
- Flag high-velocity signups for manual review
- Track email validation history per IP address
- Implement tiered verification based on velocity signals

</details>

<details>
  <summary>v1.5.0 - 10, April 2026</summary>

**Enhanced Fraud Detection and Testing Capabilities**

**Added**

Trust Verification API:

- IP-based validation parameters (`ipv4_address` and `ipv6_address`)
- VPN/proxy detection for enhanced fraud prevention
- Bot detection (OpenAI ChatGPT, GPT bots, Search bots, Mistral, etc.)
- Cloud provider identification (AWS, GCP, Azure, Cloudflare, DigitalOcean, Linode, Vultr, Hetzner, Oracle, IBM, Fastly, Bunny, Zscaler)
- IP provider analysis in `analyzed_data` response field
- VPN detection warning code: `vpn_detected`
- Common provider warning code: `common_provider_detected`
- New validation step: `vpn_ip` for VPN detection
- New validation step: `ip_provider` for provider identification

Platform Features:

- API Playground for testing verification API with real-time results
- Interactive testing interface with all validation parameters
- Live response preview with formatted JSON
- Test different email patterns and IP combinations
- View detailed validation steps and analyzed data
- Copy-paste ready cURL commands
- Support for all request parameters (soft_check, show_results, show_steps)

**Improved**

- Risk scoring now incorporates IP-based signals
- Enhanced fraud detection with VPN and bot identification
- `action` field recommendations now consider IP risk factors
- Better risk assessment for cloud provider and VPN traffic
- Documentation updated with IP validation examples

**Use Cases**

- Detect VPN/proxy usage during signup for fraud prevention
- Identify bot traffic from AI services
- Flag cloud provider IPs for additional verification
- Enhanced risk scoring with IP intelligence
- Better fraud detection for high-risk scenarios

</details>

<details>
  <summary>v1.0.0 - 01, April 2026</summary>

**Initial Public Launch**

Autheona is now publicly available for all users.

**Added**

Platform Features:

- Account creation and management
- Production and sandbox project support
- Unlimited project creation
- Access token management with expiration options
- Project rules configuration with 100+ validation options
- Real-time analytics dashboard
- Magic sign-in link authentication
- Subscription management via Polar integration
- Feedback system

Trust Verification API:

- POST /v1/public/verify endpoint
- Real-time email validation
- 100+ validation rules and checks
- Typo detection and correction suggestions
- Fraud pattern detection
- Disposable domain blocking
- MX record validation
- Domain health classification
- Risk scoring (0-100)
- Deliverability scoring
- Subdomain risk detection
- Domain age analysis
- Support for internationalized emails
- Punycode domain support

Rule Categories:

- Local part structure validation
- Subdomain structure validation
- Domain structure validation
- Internationalization support
- Length validation (RFC compliance)
- DNS and network reachability
- Typo detection and correction
- Fraud detection
- Provider and account classification
- Subdomain risk detection
- Abuse prevention
- Deliverability protection
- Risk scoring with breakdown

**Features**

- Rule presets: Verified Sign Up, Unverified Sign Up, Magic Link, Newsletter
- Soft check mode for analytics optimization
- Custom role-based address lists
- Custom educational domain lists
- Custom government domain lists
- Specific domains whitelist
- Suggestion engine for typo corrections
- Soft warning modes for typos and fraud
- Rate limiting: 10 requests/second per token
- Average API response time under 200ms
- 7-day free trial on all plans
- Monthly subscription plans via Polar
- Account and project soft deletion (30-day recovery)

**Documentation**

- Complete API reference
- Platform documentation
- Use case guides
- Best practices guide
- Getting started guide
- FAQ

**Supported Use Cases**

- SaaS signup flows (verified and unverified)
- Newsletter subscriptions
- Magic link authentication
- Enterprise B2B platforms
- Educational platforms
- AI agents and chatbots
- Internal tools and admin panels
- Government portals
- Freemium products
- Multi-tenant SaaS

</details>

## Reporting Issues

Found a bug or have feedback? Contact us:

- Email: feedback@autheona.com
- Response time: Within 24 hours