Changelog
What changed, and what it took
Including the bugs. A reliability product that only announces its wins is asking you to trust a highlight reel.
Team tier launched; anomaly canary and restore drills now cover all four backends
- Team is live: $49/month or $490/year via Paddle, same cancel-anytime and 14-day money-back guarantee as Pro. The only difference from Pro is the client ceiling — Pro caps an organization at 5 clients, Team removes that cap entirely, still one flat price no matter how many you add. White-label CSV/PDF export and email invites work identically on both.
- The ransomware/anomaly canary (mass file rewrites, extension-change patterns a plain pass/fail ping would miss) now runs on all four backends — restic, Kopia, Borg, and Duplicati — not just restic. Each was verified separately against a real local repository and a real simulated ransomware event (bulk renames adding a .locked extension), and each backend represents that event differently under the hood: Borg's diff output is one JSON object per changed path with a typed change list, Duplicati's compare command reports a delete-then-add pair. All four confirmed the same underlying finding restic surfaced first — a rename shows up as an add plus a remove, never a 'modified' file — which is why the canary scores on extension-change patterns instead of raw modified-file counts.
- Restore drills (an actual restore into a throwaway directory, timed, restored file count checked against what the backend itself reports) are now verified for real on Borg and Duplicati too, joining restic and Kopia. The Duplicati drill exposed a genuine bug: Duplicati's own documented exit codes treat 1 ("successful, nothing changed") and 2 ("successful with warnings") as success, but the agent script's original error handling reported both as hard failures. Fixed by checking Duplicati's real exit-code scheme instead of assuming any nonzero exit means failure, and separately, by switching the expected-file-count source away from a command that was silently counting directories as files.
Pro launched: ransomware canary, archive integrity, config auditor, verification ledger
- Pro is live: $9/month or $90/year via Paddle, our Merchant of Record, cancel anytime from the dashboard, 14-day money-back guarantee. No more waitlist.
- Four features gated behind it, all built and tested against real data before shipping: a ransomware/anomaly canary (restic today, other backends in progress), an archive integrity monitor for bit-rot on cold data, a config & retention auditor (Kopia today), and a cryptographically signed, tamper-evident verification ledger exportable for insurers and auditors.
- Found during real checkout testing, not before: Paddle's checkout overlay injects styles at runtime, which our Content-Security-Policy silently blocked, rendering a cropped, unusable checkout box. Fixed by loosening style-src rather than guessing at a URL allowlist. Also found the quantity selector let someone buy multiple seats of a single-seat plan; fixed by locking Paddle's price objects to quantity 1 via their API.
A real website
- Complete redesign of the site: new landing page, real documentation, pricing, security, about, and legal pages, plus this changelog.
- Self-hosted fonts, no third-party requests anywhere on the site, dark and light themes throughout.
- Real project marks for every integration (Discord, Slack, BorgBackup, Kopia, Duplicati, restic) instead of placeholder glyphs.
- A clearer pricing page: what's actually free today versus what Pro will add.
Kopia & Duplicati agents, rate limiting, Slack, self-monitoring
- Verification agents for Kopia and Duplicati, joining restic and Borg. Both were tested by planting real corruption in real repositories, and both tests changed the design: Kopia's warm local cache masked the corruption (the agent now forces a fresh cache every run), and Duplicati's default retries turned a corrupt backend into a long hang (the agent disables them for a fast, clear failure).
- Slack alerts implemented for real (Block Kit messages) and fired at a live Slack workspace; Discord likewise confirmed against a live server.
- Rate limiting on signup, login, password reset, and pings: brute force and spam now hit a wall.
- The scheduler now monitors itself and alerts us if it ever fails, and a public /health endpoint reports live database connectivity.
vestalapp.com, email alerts, password reset, account deletion
- Vestal moved to its own domain with verified email sending: alert emails and password resets now come from alerts@vestalapp.com.
- Full account lifecycle: password reset via one-hour single-use tokens (a successful reset revokes all existing sessions), and account deletion that genuinely purges every row you own.
- Fixed for honesty's sake: /health was silently serving the app's HTML instead of the real health check. An uptime monitor pointed at it would have said 'fine' forever. Found by testing it, not by luck.
Security audit and the web dashboard
- A full pass over authentication and storage: API keys now stored only as SHA-256 hashes, webhook targets screened against SSRF (loopback, private, link-local, and cloud-metadata addresses rejected), input validation tightened across the API.
- The web dashboard shipped: checks, alert channels, API key management, with a real end-to-end browser test suite clicking through every flow against a live instance.
First release
- Ping ingestion with start/pass/fail semantics, expected intervals and grace periods, and a five-minute sweep for overdue checks.
- Discord and generic webhook alerts.
- Verification agents for restic and Borg. The restic one immediately earned its keep by exposing an alerting gap during its own live test: an explicit fail ping also refreshes the check-in clock, so it needed to alert immediately rather than waiting out the interval. Fixed before launch.
Stop hoping your backups work.
Set up your first verified check in about five minutes. No card, no trial clock, no sales call.