PixelProof Changelog

A free, no-signup Meta Pixel Debugger tool shipped as part of a three-tool trio across the portfolio, giving a visitor a reason to bookmark PixelProof before they're a paying customer. The Day 23 SEO ship added six more pages under Google Perfection Standard v2, followed same-day by a content pass that fixed an EEAT unclaimed-review false positive and cut em-dash density across all three free-tool pages to clear the house style bar.

This release also ships the page you're reading: a public status page at /meta-monitor/status backed by hourly uptime snapshots, and this changelog at /meta-monitor/changelog, both built to Google Perfection Standard v2's schema and word-count gates.

The August Gold SEO ship added ten new pages across the portfolio per the Google Perfection Standard v2 content tier rules — comparison pages against named incumbents, a glossary, and retention-focused content aimed at organic search traffic beyond the core scanner product.

An Opus solo-founder due-diligence pass found that `/api/*/health` returned a 404 on every pick, which meant no uptime monitor could actually watch this app. `lib/api/health-check.ts` shipped as the one shared implementation behind all three pick health routes plus the root, checking database, Stripe, and email reachability with per-check timeouts so one slow dependency can't hang the whole probe.

JSON-LD schema also shipped on EntryProof and TariffWatch this release, closing a P0 finding from the same due-diligence pass that both picks were shipping zero structured data.

A hostile-agent security audit and a same-day "Cumshot Audit" closed out P0/P1/CVE-worthy findings: sanitized error responses, type-guarded POST bodies, closed CSRF and enum gaps, a fixed welcome route, and a repaired paid-signup-count query that had referenced a non-existent column. Checkout errors now return a proper 503 JSON error instead of a bare 500, and every API route shares one error-handler implementation.

The bigger structural change this day was cross-pick: a shared `empire.customers` identity table, a `/products` portfolio page tying PixelProof, EntryProof, and TariffWatch together, and a portfolio footer strip on all three landing pages. Full-funnel PostHog conversion events now fire across all three picks, and custom 404/500 pages, iOS input-zoom fixes, and a deferred-Sentry perf pass rounded out the day.

An internal attack-audit pass found and closed nine issues in one day: the Chrome extension's host permissions and domain lock were tightened and CORS was scoped down, the storefront-fetch helper got SSRF hardening, and the email-capture and scan endpoints picked up rate limiting after a spam-relay path was found. Security headers (CSP, X-Frame-Options, HSTS) and a CSRF Origin allowlist went on every state-changing POST route.

The Chrome extension's store-domain validator now enforces `.myshopify.com`/`admin.shopify.com` explicitly rather than a looser pattern match. A cyber-insurance activation alert cron and `insurance_status` table shipped for the M2 milestone, and a routing-and-quick-wins pass closed out a plf audit's P0 finding on root routing.

The pricing, waitlist, thanks, privacy, and terms pages all shipped this release, along with a video hero, an exit-intent Stripe coupon, and a real-time waitlist counter. Thirteen lifecycle email templates went live behind new dunning and LOI/lifecycle crons, covering everything from a 3-step dunning sequence to break-detected and deprecation-warning alerts.

Three growth mechanics landed the same day: a Broken Pixel Leaderboard, Zapier/Slack/Sheets alert webhooks, and a 3-invite Chrome-extension opt-in loop. A round of Gate 3 defect fixes closed out the day — dead copy getting wired up, missing auto-renewal disclosure, and an incumbent price-watch crawl cron that had been spec'd but not built.

This release closed the gap between "checkout works" and "checkout works safely at scale." Stripe webhooks now write to a `subscription_events` ledger with idempotency checks, so a retried webhook delivery can't double-process a payment. Seven kill-trigger SQL views started watching for the failure patterns most likely to blow up a subscription business quietly — refund spikes, failed-payment clusters, and similar.

The Vercel environment batch that went out this day also activated Rewardful affiliate tracking and an automatic Section 32-style plan upgrade path. On the observability side, Sentry and PostHog wiring, a Session Replay Verifier harness, and four new end-to-end assertions gave the M2 milestone a real safety net instead of relying on manual spot checks.

PixelProof shipped its M1 launch build at /meta-monitor: a deterministic scanner that checks a Shopify storefront for Meta Pixel, GA4, and Google Tag Manager tracking breakage, a landing page, and email-capture and unsubscribe API routes. The scanner data model landed as two new Supabase tables, `pixelproof.scans` and `pixelproof.email_captures`.

Same day, the fix-snippet library shipped with 20 paste-ready patterns covering the most common tracking failures, alongside Verified-Fix bounty backend and the first Stripe test-mode scaffolding for checkout. The Chrome extension MV3 scaffold also went out this build, laying the groundwork for the in-browser scanner that shipped in a later release.