Meta LIVE · GBP bridged · P0 & P1 FIXED & deployed on prod · 75% done.
Prod deployed 19 Jul (version 6b51909f, worker f56af218) — all copy corrections, changelog removal, security headers, GBP per-location toggle, and Drop share password/expiry are LIVE.
Main and prod now in sync at 3a401bf. Next: Stripe sandbox products + 9 secrets to unblock billing deploy.
Your next 3 moves
Stripe sandbox products + 9 secrets → billing deploy — create the 4 products in Stripe sandbox, capture their price IDs into STRIPE_PRICE_* env vars (names in .dev.vars.exampleUnblocks the billing deploy — the only queued deploy left.
Google demo video → submit sensitive-scope verification — dogfood a real post to your own Google Business Profile from Curb, screen-record it, then submit Google's OAuth sensitive-scope review. GBP publishing is live and working — this demo is the final unproven step before Google review.
Review iOS Phase 1 screens when the preview lands — the restyled inner-screen chrome (rounded cards, updated typography) is currently being built; you approved the structure, now QA the visual polish. Phase 1 is the last design pass before we hand off to TestFlight builds.
DoneDoingNextWaitingGate-openLaterYou = only Luke can do it
🌐 Website & landing
withcurb.com public face · vault: curb-landing-legal
DoneMain landing page + 4 product pages — LIVE on prodYour new marketing site merged + deployed 18 Jul, all pages 200, new pricing showing
DoneEnable "Always Use HTTPS" on withcurb.com (+ curbsocials.com)CF dashboard → SSL/TLS → Edge Certificates → toggled on 19 Jul by Luke. Verified: http:// → 301 → https (path-preserved), https 200, Stripe webhook 400 unsigned. Rollback: toggle off.
DoneMarketing copy truth fixes + fabricated changelog page removed — DEPLOYEDFalse Facebook/Apple Maps/Bing claims + "auto-post" wording corrected, and the invented Jan-2026-launch changelog page deleted entirely. Deployed to prod 19 Jul (version 6b51909f). Verified: /changelog now 404, false claims stripped from site.
DoingRetiring the old pre-redesign marketing pages/landing, /index.html, /about.html still serve old content publicly — including fabricated "12 shops" claims — while the new site is being redirected in over the top of them.
⚙️ Web app
~/Projects/project-social · vault: with-curb
DoneAll 4 products live on prod behind the waitlist gate
DoneLast open security item closed — IG comment-reply authz + 4 rehearsal P3s fixedMerged to main 18 Jul — DEPLOYED to prod 19 Jul with the P0 batch. Org-isolation also hardened: a new automated check now fails the build on any un-scoped database query.
Done✅ P0 FIXED + DEPLOYED — unintended live IG publish (18 Jul): schedule dates silently dropped + invented +30min approve time + publish-before-recordShipped to prod 19 Jul (main `472d7ba`, version `f56af218`). Verified on the deployed bundle: no invented time, and the publications row is claimed BEFORE any Instagram Graph call. 1171/1171 tests green. Real IG scheduling is now safe.
Done✅ P1 FIXED + DEPLOYED — magic-link sign-in 403 "Cross-site request blocked" (19 Jul)Interstitial referrer meta `no-referrer` → `strict-origin` + explicit null-vs-malformed Origin handling. Verified e2e in real Chrome on prod: before-test failed twice with 403; after-test signed in successfully to /app/dashboard. Main tip `4639fb9`, prod `d4141b72-afd7-441f-b090-e8908cc37db5`. 1221/1221 tests green.
DoneEdit + delete a queued post — API shippedDeployed 19 Jul with the P0 batch: POST /api/queue/:id/edit + /delete. Unblocks the iOS build-6 edit/delete screens, which were 404ing. Also enabled production logging (observability) — prod was logging nothing, which blocked the P0 investigation.
DoneStaging (preview) now password-gatedSITE_PASSWORD set on preview — closes the "staging serving ungated" gap flagged 19 Jul
NextSMS ungate: one-way, quota 0 ($15/100 pack unlocks)Queue-authz half SHIPPED 18 Jul · SMS half ships with the Mobile Message window · template: "Shop name: message (no-reply)" + opt-out link on marketing
DoneSecurity headers + deploy-safety fixes + per-location GBP toggle + browser-shaped test coverage — DEPLOYEDCache-Control guard, COOP, /health env-leak fix, HSTS preload token (deliberately not submitted) · unqualified deploy target removed from prod data · owner/admin gate added to per-location Google listing toggle · browser-shaped test coverage + MCP body-limit fix. Deployed to prod 19 Jul (version 6b51909f).
DoneDrop share password/expiry wiring + PBKDF2 hashing — DEPLOYEDWires up the share-link password + expiry fields the client already showed but never sent; upgrades hash storage to PBKDF2. Deployed to prod 19 Jul (version 6b51909f).
NextLogout CSRF fail-open found: a missing Sec-Fetch-Site header force-logs-out every deviceSame fail-open shape as the P1 sign-in bug — but fixing it is a behaviour change, so it needs your call before anyone codes it. Found 19 Jul, not yet fixed.
NextFinal prod smoke test before gate-open
🛂 Approvals (external)
Meta · Google · vault: curb-meta-app-review, curb-launch-readiness
DoneMeta App Review — APPROVED 17 Jul 🎉All 3 IG permissions after a 23-day review
DoneMeta app PUBLISHED — Curb Socials is LIVE 🎉18 Jul: Publish badge green, zero required actions — real customers can connect Instagram
DoneConsole URL migration complete — Meta + Google cleaned, carve-outs dropped18 Jul: IG webhook live on withcurb · curbsocials purged from both OAuth clients · code shipped, 1119 tests · /webhooks/* stays until Stripe endpoint confirmed
DoneChannel truth check17 Jul: IG perms all "Ready to publish" · FB posting NOT granted · GBP quota still 0 → launch copy claims Instagram only
DoneGoogle Business Profile publishing — UNBLOCKED + LIVE via the CS-project bridgeGBP now live at 300 QPM via the allowlisted Cornerstone Cloud project (683391900680) — e2e verified, 6 locations loading, "With Curb" consent screen confirmed, no more 429s. Curb's own project's appeal (case 3-5341000041476) stays open in parallel, a win there is a bonus not required.
DoneGoogle appeals filed — email 17 Jul, form 18 JulEmail bounced ("PII-only channel") → proper form submitted with the same ask
LaterGoogle OAuth verification (Gate 2) — reserved, not submittedPrereq (dogfood GBP post) now unblocked, but the submit itself stays deliberately parked — reclassify scope, logo, demo video, submit, on your call
LaterMeta cleanup: rotate reviewer login + remove temp allowlistYour call: no rush, test accounts only
📱 iOS & App Store Connect
~/Projects/curb-socials-ios · vault: curb-ios
DoneApp built — all 4 products + parity waves, mobile auth + email→app sign-in
DoneApple company account + D-U-N-S — sortedYour CAGL company team 3272YE679N holds Curb; no enrolment or conversion needed
DoneTestFlight — internal builds live on your iPhoneBuilds 2+3 uploaded 7 Jul, fully autonomous via the CAGL API key
DoneParity burn-down complete — TestFlight build 4 on your phoneTonight: 4 branches merged, prod deployed, build 4 uploaded on your go
Donev2 mockup sign-off — Phase 0 (shell reskin) approved + builtPhases 1–4 (inner screens) still to build — those screens still wear the old design for now
DoneTestFlight build 6 uploaded — v2 Phase-0 reskin + IG-connect fix + queue edit/deleteInner screens still wear the old design — Phase 0 reskinned the shell only. Test it on your phone.
DoingPhase 1 inner-screen restyle + new photo-crop screenYou approved the chrome/content, rejected the inner styling as wireframe-y. Restyling to the rounded/white-card look + building a per-destination crop screen; updated HTML preview to follow before any Swift/TestFlight work.
NextIAP from launch at +30% markup (your form call)UNBLOCKED — tiers locked: $12.99 / $37.99 / $76.99 / $128.99 · StoreKit + SBP enrolment + Stripe entitlement sync · ready for a session
WaitingApple Small Business Program enrolment — SUBMITTED, awaiting Apple's approval email30% → 15% App Store commission. Submitted 19 Jul from the Account Holder session; prerequisites (Paid Apps Agreement, bank account, tax forms) all verified active. Effective date keys off approval, not submission — could land ~16 Aug or ~13 Sep depending on when Apple replies.
YouActivate Stripe live + create the pricesPricing locked → click-list ready (4 products, 9 secrets) · sandbox first, live at gate-open · same sitting: confirm Stripe's webhook endpoint URL is on withcurb (then the last carve-out drops)
Gate-openBilling on + $1×3 intro offer liveShips with the public launch, not before
📣 Comms & marketing
vault: curb-comms-lifecycle, curb-socials-launch
DoneEmail infra: Resend Pro + verified sender send.withcurb.com
YouClaim @withcurb handles — X · TikTok · YouTube · LinkedIn · Threads · FB page · bio pack ready →Handles + fallbacks, bios per char limit, art pointers, first pinned post — IG already yours
NextDogfood proof: post once → live on your own IG, screen-record itUNBLOCKED — app is Live on Meta; do it any time · the capture becomes the hero Reel
NextFounding cohort: approve comp shops + send founding-invite email6-months-free draft ready for your review
NextIG warm-up: 12-tile grid from the 107 built assets + teasersAll CTAs say "join the waitlist" while the gate is closed