All environments on Starter — development, staging and production API keys are now included on the Starter plan, not production only. Trial apps gained this in 0.13.2; it now carries through when you subscribe
Fixed: the proxy base URL shown in Settings and in the setup guide was missing the api. subdomain. If you set up an integration before 27 September, check your base URL — it should be https://api.signalvault.io/proxy/openai/v1. The old value failed on every request
Fixed: email verification now requires an explicit click. Corporate email scanners were following verification links automatically, which could mark an account verified — and send its welcome email — before the recipient ever opened the message
Fixed: an expired verification link now offers to send a new one instead of dead-ending
You now get an email when your last free trial request is used, so a paused integration is never a surprise
Trial-limit responses now carry an upgrade_url field alongside the existing error type and code, so your client can link a developer straight to billing instead of hard-coding the path
Fixed: guardrail block responses now link to the dashboard for the environment the request came from, rather than always the production host
Hardened: the export endpoint caps the days parameter at 365, and the dashboard's live event handler now goes through the same app-ownership check as every other view
Rebuilt the homepage
Events list: one-click filters for the last hour, 24 hours and 7 days, a live indicator while events are arriving, and new rows highlight as they land
The setup guide can be reopened from your app dashboard after you dismiss it
Refreshed typography, and a mobile navigation menu that collapses properly on small screens
v0.13.2
Trial & Onboarding Fixes
Trial apps can now create development and staging API keys — evaluate SignalVault locally before pointing production traffic at it
Fixed: failed requests no longer count against your free trial — upstream provider errors, budget rejections, guardrail blocks and replayed request IDs are not charged
Fixed: the environment used to select guardrail rules is now taken from your API key and can no longer be overridden by a request header or body
Fixed: apps with a lapsed subscription no longer see a "free trial remaining" banner
v0.13.1
Security Patch
Fixed: tightened authorization checks across all dashboard views
Session cookies upgraded from SameSite=Lax to SameSite=Strict
Published a security contact at /.well-known/security.txt so researchers have a documented way to report issues
Status page now links to live uptime history
v0.13.0
Reliability & Observability
Structured JSON logging in production — every request and background job now emits machine-readable fields for easier filtering in log aggregation tools
Health check endpoint now validates database connectivity, so infrastructure monitoring catches outages before customers do
Improved background job resilience — failed delivery jobs are detected and recoverable without manual intervention
Memory allocation increased to handle higher concurrency without degradation under sustained load
v0.12.0
Security & Dashboard Improvements
Dashboard app access hardened — each app is now strictly scoped to its owner account on every load
Improved session handling and auth consistency across all dashboard views
Email verification flow made more robust with better error recovery for delivery failures
v0.11.0
Non-Streaming Tool Call Capture
Tool calls in non-streaming proxy mode are now fully captured and audited — previously only streaming requests logged tool interactions
Guardrail rules evaluate tool call inputs and outputs on both streaming and non-streaming paths, and violations are recorded for both. Enforcement — actually blocking or rewriting a proposed tool call — ran only on non-streaming responses
v0.10.0
Tool Call Audit Logs
Tool calls captured automatically when proxying OpenAI or Anthropic — no SDK changes required, works for streaming and non-streaming
"Tools Offered" section on the request detail page showing which tools were exposed to the model on each request
PII and secret detection extended to tool inputs and outputs, with the JSON path of the offending field surfaced on every violation
Field-level redaction in the audit log — sensitive values masked while sibling fields stay readable for debugging
Filter the events list by tool calls alongside requests, violations, errors, and budget
v0.9.0
Launch Hardening
Cloudflare Turnstile bot protection and disposable-email domain blocking on sign-up
Email verification required before dashboard access, with rate-limited resend
Up to 5 API keys per app with labels, last-used tracking, and revocation
Real-time event feed in the dashboard — new events appear without a page reload
Cursor-based pagination on event lists, 7-day activity counts on app cards, and analytics auto-refresh
Production log aggregation with error-rate alerting
v0.8.0
Refreshed UI
Redesigned dashboard with new sidebar navigation and improved mobile support
Refreshed landing, pricing, blog, and documentation pages
Cleaner, more consistent visual design throughout the app
v0.7.0
New Rule Types
Prompt injection detection with configurable sensitivity (standard and strict modes)
Regex match rule with label support and execution timeout protection
Keyword blocklist with case-insensitive word-boundary matching
Model allowlist to restrict which AI models an app may use
v0.6.0
Transparent Proxy Endpoint
Proxy endpoint: point your existing OpenAI or Anthropic client at SignalVault with a one-line URL change — no SDK required
Full guardrail enforcement in-path: block and redact rules stop requests before they reach the upstream provider
Streaming (SSE) fully supported for both providers — chunks forwarded in real-time, response logged after stream completes
Anthropic token and cost tracking for both streaming and non-streaming responses
Rate limiting per app (60 req/min) rather than per IP
v0.5.0
Webhook Alerts, Response Redaction & Data Retention
Webhook alerts: send alerts to any HTTPS endpoint — Slack URLs get rich Block Kit messages, all others get plain JSON
Response redaction: rules with action 'redact' now mask matched content in stored payloads before write
Data retention card in Settings: see your retention period, total stored events, oldest event date, and next purge cutoff
v0.4.0
Email Alerts & Pricing
Email alerts for policy violations, budget breaches, and AI errors (Growth plan)
Configurable alert settings: event types, minimum severity, cooldown, and recipient
Pricing page now lets signed-in users subscribe directly without leaving the page
Plans & Billing documentation added
Node.js and Python SDK support added
v0.3.0
Budget Controls & Billing
Set monthly cost and daily token limits per app
Dashboard alerts when budgets are exceeded
Export audit logs as CSV or JSON
Dashboard analytics: request volume, violation rate, and cost tracking
All prompts and responses are now encrypted at rest
Stripe billing for Starter and Growth plans
v0.2.0
Security Hardening
Stronger API key hashing for improved security
Rate limiting on login and API endpoints
Improved session security
v0.1.0
Initial Release
AI request and response logging with full audit trail
Guardrail rules: PII detection, secret scanning, token limits, model allowlists
Dashboard with filtering, sorting, and request detail views
Node.js SDK with OpenAI-compatible wrapper and mirror mode