Changelog

This release gives every user visibility and control over their stored files, and rebuilds the API key management experience.

Storage Asset Management Page

• A new Settings > Storage page lets users manage their files in S3-compatible storage: list uploads with usage stats, preview assets, generate presigned download links, and delete files individually or in bulk.
• It is backed by new authenticated /assets Hono routes — every operation is strictly scoped to the user's own storage prefix, with thorough key validation and 300+ lines of service tests.

API Keys & Login Experience

• The API key settings were rebuilt around a table with a per-key actions menu (details, test, delete) and an on-demand verification dialog, so users can confirm a freshly created key actually works without leaving the page.
• The OTP login form layout was polished, with cleaner alignment of the password field and the forgot-password link.

This release completes a security audit across authentication, billing, and infrastructure, and raises the engineering quality baseline across the board.

Security Fixes

• Closed a payment bypass: Creem and Stripe webhooks no longer fall back to parsing unverified bodies when no secret is configured — production now requires a webhook secret (mirroring the existing Dodo guard), with gateway security tests included.
• Fixed reflected XSS on the newsletter unsubscribe page and replaced the token scheme with HMAC-SHA256 signed tokens (constant-time comparison), so unsubscribe links can no longer be forged.
• All routes now send baseline security headers: HSTS, X-Frame-Options SAMEORIGIN, nosniff, Referrer-Policy, and a restrictive Permissions-Policy.

Reliability & Engineering Quality

• Server environment variables are validated at startup, so misconfigured deployments fail fast with clear errors instead of breaking mid-request.
• Three levels of App Router error boundaries (route/app/global) show localized error pages; auth emails (OTP, magic link, password reset) report real errors instead of silent success when delivery fails; the Hono API gained a central error handler and a request-body size limit.
• A CI workflow runs type-check/lint/unit on every push, Playwright e2e now runs against a production build with retries, and the webhook-to-entitlement chain has regression tests.

This release trims the template: low-usage, high-maintenance built-ins were removed so buyers start from a leaner baseline.

AI Chat Removed

• The built-in AI chat workspace — pages, Hono API routes, database queries, UI components, and the AI SDK dependencies — was removed, so projects that do not ship AI features no longer carry the extra code, dependencies, or attack surface (8 package.json entries dropped, ~3,000 lines of feature code removed).
• Breaking change: migration 0005 drops the ai_chat_conversation and ai_chat_message tables (CASCADE). Derivative projects that used AI chat should export any conversation data before pulling this upgrade.

Fortress Layout Removed

• The unmaintained fortress account-layout variant (~300 lines) was deleted, leaving the default layout as the single built-in path and reducing customization confusion; other shapes can be added as custom layout variants per the docs.

This release polishes the landing page community entry point and the default brand assets.

Updates

• The landing header (desktop controls and mobile menu) gains a config-driven Discord button, so a single config entry surfaces your community link.
• Default favicon, app icons, OG image, and hero images were redesigned at higher resolution, giving fresh deployments a polished look out of the box.
• Locale handling was refactored to an enum with safer default-locale resolution, reducing i18n misconfiguration risk in derivative projects.

This release adds Dodo Payments as a first-class Muse Billing gateway, so teams can launch checkout, webhooks, and customer portal flows alongside Creem and Stripe.

Dodo Payments Integration

• Added the muse_dodo gateway with checkout session launch, webhook verification, contract sync, and customer portal links.
• Extended product catalog and environment templates with Dodo API keys, webhook secrets, environment mode, and lifetime/monthly/yearly product ID variables.
• Registered the gateway in Muse Billing orchestration with unit and API coverage for gateway behavior, mappers, and access resolution.

This release strengthens the email sending pipeline with multi-provider support and robust error handling, cleans up authentication form styling, and brings the dependency tree up to date.

Product

• Enhanced email configuration to support multiple providers (Resend and Cloudflare), with environment examples updated accordingly
• Improved email sending logic with reply-to address support and better error handling for delivery failures across contact and newsletter routes
• Removed decorative asterisks from authentication form titles (login, signup, forgot password, reset password, 2FA verify) for a cleaner interface
• Added comprehensive unit tests for contact route, newsletter route, and mail sending logic

Code

• Batch-updated 26 dependencies including Next.js 16.2.5, React 19.2.6, fumadocs-mdx 15.0.0, Zod 4.4.3, and Wrangler 4.89.1
• Renamed next.config.ts to next.config.mts for explicit TypeScript module config with Cloudflare and MDX support

This release focuses on operational control and authentication flow quality.

What changed

• Added admin user ban and unban functionality.
• Added supporting design spec documentation for user moderation.
• Improved auth and settings testability with additional data-testid coverage.
• Refined redirect handling and type safety in auth-related flows.
• Optimized changelog timeline layout alignment and restored sticky date behavior.

Commits included

• 91260b7 feat(admin-users): implement user ban and unban functionality
• e29f9b1 docs(spec): add admin user ban design
• 45bf4ef feat(two-factor-auth): enhance TwoFactorVerifyForm with data-testid attributes for improved testability
• d655ee4 feat(password-input): refactor PasswordInput component to use forwardRef and improve type safety
• 91be374 feat(settings): add data-testid attributes for improved testability in confirmation and delete account components
• e470adb refactor(auth): streamline redirect handling and enhance type safety

This update introduced practical product controls for both developers and operators.

What changed

• Added API token feature support with conditional rendering paths.
• Added hideBorderX configuration for more flexible header presentation.
• Simplified default layout header structure for a cleaner top-level navigation area.
• Updated tooling config to exclude skills directory from Biome and TypeScript checks.

Commits included

• d563264 feat: implement API tokens feature with conditional rendering
• 546c9a0 feat: add hideBorderX configuration option for header
• 90bec07 refactor: simplify header structure in default layout
• ddac416 chore: update biome and tsconfig to exclude skills directory

MuseMVP is officially released as of 2026-03-10.

This release marks the point where the project is ready to be used as a real SaaS product foundation, not only a starter template.

Related links

• Docs: https://musemvp.com/docs
• Features: https://musemvp.com/features
• MuseMVP Docs: https://musemvp.com/docs

Related commits (selected)

• 91260b7 feat(admin-users): implement user ban and unban functionality
• e29f9b1 docs(spec): add admin user ban design
• 45bf4ef feat(two-factor-auth): enhance TwoFactorVerifyForm with data-testid attributes for improved testability
• d655ee4 feat(password-input): refactor PasswordInput component to use forwardRef and improve type safety
• 91be374 feat(settings): add data-testid attributes for improved testability in confirmation and delete account components
• e470adb refactor(auth): streamline redirect handling and enhance type safety
• 8a9bc25 refactor: enhance muse-billing module with improved documentation (#45)
• 9050bb6 feat(agents): enhance feature delivery and testing guidelines (#41)
• 36eb81d chore(deps): update package versions in package.json and pnpm-lock.yaml
• 0f69648 feat(api): implement avatar upload with signed URL and enhance test coverage (#40)
• dc08c88 feat: implement avatar upload functionality with signed URL generation
• 383e1c0 chore: enhance API key management and update related tests
• 6cf1d0d feat: add test framework module + optimize AI rules file + update nextjs and better-auth. (#31)
• 43175cd refactor: restructure blog and legal related pages; optimize landing page rendering (#29)
• cbc4963 feat: introduce MuseMVP skill for customizing SaaS app home route
• 7f96f88 refactor: migrate from content-collections to Fumadocs MDX and update related configurations
• a0ac45f feat: enable conditional display of DeleteAccountForm based on configuration
• d563264 feat: implement API tokens feature with conditional rendering
• 546c9a0 feat: add hideBorderX configuration option for header
• 50855ce feat: add new skills and documentation for brainstorming and better-auth practices
• fd14861 refactor: restructure landing page components for improved modularity
• ec953dc fix: update pricing section configuration based on billing settings
• dfc11be feat: add discount code functionality to pricing and error handling
• ···