v1.2
JULY 8, 2026
FEATURE
SECURITY
FIX
- ⭐Referral & Partner Program launched — anyone can earn a commission sharing Forget Me Not, with a personal link, live dashboard, and admin-managed payouts
- 🔒Full payment security review across every rail — crypto and card checkout now carry additional server-side verification, atomic replay protection, and live-price sanity checks
- 🔧Preserve Forever hardened — permanence now works reliably no matter how you signed up, wallet or email
- 🔧Smoother memorial editing — every owner can now edit their memorial's details without a hitch
- 📷QR scanner fixes — scanning a printed memorial sticker or plaque now works reliably across devices
- 🧭Persistent "My Memorials" navigation — no more needing a new sign-in link just to get back to your dashboard
- 📦Fulfillment tracking — an internal system now tracks every physical QR sticker that needs to be mailed once a memorial is preserved forever
- 📄Full Privacy Policy and expanded Terms of Service, viewable anytime from account settings
- 🔔Anniversary reminders — optional yearly nudges for a loved one's anniversary and birthday
- 💵Simplified pricing — three clear plans: Remember, Legacy, and Pet
v1.1 — Security Update
JUNE 11, 2026
SECURITY
- 🔒SOL payment routes now verify treasury received funds — previously only checked sender balance decreased
- 🔒SKR purchase amounts now computed server-side — client can no longer supply their own price
- 🔒Storage add-on SOL route now performs full on-chain verification with deduplication
- 🔒All database query inputs validated and escaped — injection protection across all payment routes
- 🔒creationToken no longer returned in email verify responses for redeemed packages
- 🔒creationToken no longer written to public memorials document
- 🔒Storage add-on SKR route now deduplicates signatures
- 🔒Session tokens separated from magic link tokens — memorial updates use distinct HMAC session credentials
- 🔒Memorial search capped at 50 results with minimum query length
- 🔒Proxy image endpoint restricted to exact allowlist — open S3 proxy regex removed
- 🔒Magic link email now only sent on first verification
- ✅Admin gate confirmed secure — Cognito wallet claim is cryptographically bound