What's new in Stacktora

10 more Vault recipes. Outbound Webhook Delivery (the sending counterpart to Webhook Receiver — signing, retry/backoff, a real delivery log), AI Content Classification & Moderation, A/B Testing & Experimentation, Secrets & Config Management, Incident Management & On-call, a Push Notification Device Registry, Geofencing & Location Tracking, Customer Health Score & Churn Signals, Newsletter & Subscriber List Management, and a Consent Management Platform.

10 more Vault recipes, opening two more categories. Content Moderation Pipeline, Coupon & Promotion Engine, Referral Program Backend, Time Tracking & Timesheets, Social Graph / Follow-Feed, Digital Asset & License Delivery, Inbound Email Processing, and Reverse ETL / Data Warehouse Sync — plus the first recipes in two new categories: Compliance (a GDPR / Data Rights Request Service) and Scheduling (Booking & Appointment Scheduling).

10 more Vault recipes, including the first in a new Support category. Scheduled Reports & Data Export, a Public API Product Starter (API keys and per-key rate limits — distinct from the API Gateway recipe, which proxies an existing backend), an Internal Admin/Back-office Backend, Real-time Collaboration & Presence, a Two-sided Marketplace Backend, Onboarding & Drip Campaigns, Document Generation, an Internal Wiki/Knowledge Base, a Customer Support Ticketing Backend (Support, new), and an Uptime & Status Page Backend — the same shape as Stacktora's own dogfooding project for this exact use case.

4 more Vault recipes. Usage Metering & Billing (Stripe-connected, for consumption-based pricing rather than flat plans), an Audit Log / Activity Trail Service, a Data Pipeline / ETL Starter (the first Python + Kafka + Celery recipe in the Vault), and a Headless CMS Backend.

4 more Vault recipes. A Passwordless / MFA Auth Starter (WebAuthn/passkey-ready — a genuinely different pattern from a basic login/SSO starter), a Feature Flags & Remote Config Service, Inventory & Order Management, and a Chat & Messaging Backend.

7 more Vault recipes, spanning two brand new categories. Centralized Logging & Metrics (ClickHouse + Redis), a Ledger & Double-Entry Accounting starter (Postgres — for tracking where money went, not processing payments), File Upload & Media Processing (MinIO + a worker), an API Gateway & Rate Limiter, a Mobile Backend-as-a-Service starter, plus the first two recipes in two new categories: Notifications (unified outbound email/SMS/push, queue + worker) and Search (Meilisearch in front of Postgres, instead of a slow ILIKE query standing in for real search).

2 more Vault recipes: Multi-tenant SaaS Starter and Webhook Receiver & Event Ingestion (the latter opening a new Webhooks category) — tenant-scoped data isolation, and idempotent, signature-verified webhook handling with a retry-safe queue. Two more patterns everyone ends up building from scratch.

The actual app page — where the wizard lives, likely the single most-shared link on the whole site — had no og:title or og:description at all, and its <title> still said the old "Environment Bootstrap Script Generator" framing. Now has its own title and description, distinct from the homepage's.

The homepage's <title> and social-preview metadata (og:title, og:description) still said an older tagline — "Bootstrap your stack. Once. Everywhere." — while the og:image itself had already been updated to the current messaging. Both now say the same thing.

Four real gaps in the recipe catalog, closed. Vault now has a dedicated Auth/SSO starter (Postgres + Redis sessions, OAuth-ready), a GraphQL API starter, an LLM Gateway/Proxy recipe (Redis-backed caching and rate limiting in front of one or more providers), and a Job Queue & Scheduler starter — the kind of thing every team currently has to build from scratch or bolt onto a recipe that wasn't meant for it.

Generating a stack whose stacktora.json didn't include a config.env array — which the schema has always allowed, since it's optional — could crash generation entirely instead of just producing a file with no custom variables. Caught while building the recipes above; two of the four didn't need any custom env vars, which is exactly the case that had never been hit before.

An MCP server, built into the CLI you already have. stacktora mcp runs the same CLI as an MCP server over stdio, exposing read, init, install, recipes, sync, check, plan, audit, doctor, and status as tools an agent can call directly — no separate service, no new install, same package and engine as everything else. Point any MCP-compatible client at npx -y stacktora mcp.

Compliance can now notify you instead of waiting to be checked. Add a Slack webhook URL and/or turn on email alerts under the dashboard's new Notifications section, and you're pinged once, right at the moment a repo that was passing starts failing — not on every failing run afterward, and not on a repo's first-ever report. A "Send a test alert" button confirms it's wired up before you actually need it.

The Compliance dashboard's copy-paste CI snippet had the wrong input name. It showed token:, but stacktora/audit-action actually expects stacktora-token: — the action silently ignores inputs it doesn't recognize instead of failing, so CI ran green while quietly never reporting anything to the dashboard. If you copied this snippet before today, update the with: block in your workflow to use stacktora-token: instead of token:.

Tracked repos can now be removed from the compliance dashboard — a "Remove" action next to each one stops tracking it and clears its run history from the view. Doesn't touch anything on GitHub or revoke any token; just forgets the repo locally.

Connecting the Compliance GitHub App could fail with a blank error page right after installing it on a repo, instead of redirecting back to the dashboard — a missing internal reference broke that one step. Reconnecting now completes cleanly and shows "Connected" as expected. Also tightened up the CI-snippet box on the Workspace Tokens section, which was stretching full-width with mostly empty space around five short lines of YAML.

Compliance is now visible everywhere it's relevant, not just on its own page. The wizard's first step now points to it directly for anyone building for a team. The docs page's CLI section now walks all the way through to the dashboard instead of stopping at the editor extension, and its plans table finally lists it. The Team plan card on the homepage — the actual place someone decides to upgrade — didn't mention it at all before; now it's its own line. The in-app FAQ has a matching new entry.

Turn a failing check into an actual required check. Connect the Stacktora Compliance GitHub App from the compliance dashboard, and "Require this check" becomes one click instead of a manual trip through GitHub's branch protection settings — a policy violation can now genuinely block a merge, not just show up red on a dashboard. Reads a repo's existing protection rules first and merges into them rather than overwriting anything already configured there. A plain deep-link to the same settings page is still there as a fallback either way.

Vault recipes now show whether they match your team's policy. If you're signed in with a company policy saved, every recipe in the gallery gets a "Matches your policy" or "Violates your policy" badge, and the recipe page itself shows the full check-by-check breakdown — the same 9-check logic the CLI, the GitHub Action, and the dashboard all already use. No policy saved yet just means no badge, nothing broken.

Author company policy without hand-writing JSON. The compliance dashboard now has a real form for it — pick allowed runtimes, banned datastores, banned services, required outputs, and toggle the health-gate and env-source requirements. Save it to keep editing later, or download the generated company.stacktora.json straight to commit. Clicking into any tracked repo also now shows its last 20 runs as a pass/fail history strip, not just its current status — so a repo that drifted out of policy and back is visible, not just its latest state.

Compliance dashboard. Every stacktora audit run in CI can now report back to a live dashboard instead of vanishing after the log scrolls away. Generate a workspace token in Settings, drop it into your GitHub Actions secret, and any repo running stacktora/audit-action registers itself automatically on first report — no manual connection step. Each tracked repo shows current pass/fail status and exactly which check failed, with detail, not just a red X. This is Stacktora's first move from "generates your stack once" to "knows whether it still matches what your team decided" — the actual point of a company policy file, not just a nice-to-have step in the wizard.

The header shared by every public page now lives in one file (/assets/nav.css) instead of six separate copies — a change to the nav now only needs to happen once, not once per page. Nothing should look different; this is purely about not repeating today's alignment saga next time.

Settings now shows a live preview of your actual public profile — username, bio, social handles, verified badge — right where you edit it, updating as you type. No more saving and leaving the app just to check what it actually looks like.

The homepage FAQ now points to the full documentation at the bottom, matching the same pattern already used in the in-app help drawer — one canonical place for anything beyond the handful of pre-signup questions covered there.

The rail's logo was getting visually blurred out whenever the rail expanded on hover — caused by last round's fix for the Stack Summary popup, which raised the top bar's priority above the rail without accounting for the top bar's own background staying in a fixed position. The top bar (not just its content) now actually slides clear of the rail when it expands, the way it visually should. Also removed the Library button from the top bar, since it's been sitting in the rail this whole time too — only the Stack Summary badge lives there now. Found and removed a stray vertical line in the header — a leftover divider from before the layout changed shape, no longer separating anything.

Stages 3 and 4 of the shell migration: Vault, Profile pages, Followers/Following, and the admin dashboard all now use the same left rail as the app instead of the marketing site's header — full width, no more Features/Pricing/FAQ nav on pages that were never marketing pages to begin with. Vault keeps its own wordmark, now shown at the top of its own content instead of competing with the rail for the same small logo slot. Built as a genuinely separate shell (a new file, not a change to the existing one) specifically so every other marketing page — home, about, docs, changelog, press, roadmap, and the rest — keeps working exactly as it did, completely untouched.

Stage 2 of the shell migration is done — the old flyout menu is gone entirely. Its still-unique items got real homes instead of just being deleted: Language moved into Settings → Account & security, Terms/Privacy/Support moved into the bottom of the Help page, Admin dashboard moved into the account menu (admin-only, same as before), and the rail's logo is now a clickable link back to the marketing site, replacing the old "Home" entry. Templates and Submit a recipe weren't moved at all — both were already reachable elsewhere (the in-wizard template banner, and Vault's own submit button) and never needed the flyout in the first place.

Renamed step 1 from "Define services" to "Configure stack" — everywhere it shows (rail, stepper, step heading, command palette), since all of them read from the same underlying label. English only for now; the other 13 languages still say the old wording until those get updated too.

Made the top bar's shift-away-from-the-rail-when-hovered fully CSS-native instead of depending on a separate JS reactivity round-trip — removes a brief window where the rail could visually finish expanding before the top bar had caught up. Confirmed no Library button remains duplicated in the top bar (already living in the rail) and cleaned up a stale comment left over from when one used to be there.

Settings finally has the sub-nav split (Profile / Account & security / Workspace / Plan & billing / Defaults) from the shell mockup — it had shipped as one long scroll instead. All eight existing settings sections moved into the tab that fits them, nothing rebuilt from scratch; a genuinely new Plan & billing tab was added, reusing the same upgrade/billing actions already in the account menu.

The Stack Summary popup was extending off the left edge of the screen entirely — not just behind the rail, past the actual browser edge. It was anchored to grow leftward from its trigger, which used to have room before the rail existed; now it grows rightward instead, where the space actually is.

Mobile bottom nav had uneven spacing (one group of 3 icons crammed next to a group of 1) and the account icon's popup menu was rendering in the wrong place entirely, off in a corner disconnected from where you tapped. Both fixed. Also fixed the Stack Summary popup silently rendering behind the rail on desktop even after being given a higher priority — the real cause was the top bar itself capping everything inside it, not the popup's own settings. Trimmed three now-duplicate entries (Library, Get Help, Browse the Vault) out of the older menu, since all three now live in the rail — kept everything still unique to it (Templates, Language, Submit a recipe, Admin dashboard, legal links).

Stack Summary and a few other popups could render behind the new rail instead of in front of it — fixed. Mobile was missing the Stacktora logo entirely after last round's cleanup, and the Live Preview's floating trigger button was overlapping the new bottom nav bar — both fixed. Live Preview's file dropdown now caps at 8 visible files with a soft scroll fade instead of growing forever. "View profile" added to the account menu. The redundant "My Account"/"Login" link next to the Start Building button — which went to the same place — is gone from every public page.

Three regressions from the new rail: it was overlapping the account menu in the bottom-left corner, and the top bar's own logo was showing right next to the rail's, doubling up. Account menu now lives inside the rail itself; the redundant top bar logo is gone (its "back to start" action moved to the rail's Define services button). Also replaced the Live Preview's old file tab strip with a real dropdown — click it, every file listed at once, jump to any of them directly.

Settings and Get Help now live in a persistent left rail alongside Templates, Library, and Vault — instead of the general flyout menu. Settings and Help now render as full sections rather than slide-over panels. Stage 1 of a larger shell consolidation; the old menu still exists underneath while this gets tested, nothing removed yet.

In-progress wizard selections now persist across page loads, the same way settings already do — which means "View your profile" from Settings no longer needs to open in a new tab just to protect unsaved work. First of a few passes at making navigation across Stacktora feel like one connected app instead of separate stops.

Followers and following are now their own pages — click the count on any profile to see the actual list, same pattern as everywhere else. Follow-back buttons work right from that list, no need to open each person's profile individually.

Follower and following counts on profiles now reflect the true total, not just the people visible in the list below. Every follower and following entry also has an inline follow-back button now — no more needing to click through to someone's profile just to follow them back.

Cleaner verified badge, and every new account now follows @ops automatically on signup — unfollow anytime, same as following anyone else.

Follow other builders, and a verified badge. Profiles now show your plan tier, followers and following (each side only ever lists people who also have a public profile), and a follow button. Verified accounts — confirmed by email — get a blue badge next to their handle. New signups get a verification email; existing accounts were grandfathered in.

Public profile pages. If you've set a public username, your profile is now live at stacktora.com/u/yourname — your bio, social handles (still plain text, never a link out), your current workspace if you're part of one, and your approved Vault submissions. Direct link only for now — no directory or search page. Add a bio from Settings to fill yours in.

stacktora status now catches crashed containers. It was checking docker compose ps without -a, which quietly omits anything that's exited — a service could crash and status would just... not mention it. Fixed to always show every container, exit code included.

Open a Vault recipe straight into the generator. Every recipe page now has an Open in generator button — no CLI needed to try one out, everything loads into the wizard fully editable before you generate anything.

Deploy the frontend to Vercel, and a Supabase starting point. Toggle on vercel.json (needs the optional web frontend) or supabase/config.toml (needs Postgres) in step 2. Push to GitHub and each platform's own Import flow picks the file up automatically — Stacktora generates the native config, but deliberately never asks for a Vercel or Supabase credential itself.

Italian, Vietnamese, and Turkish localizations — Stacktora now speaks 14 languages.

A head-to-head comparison table right on the homepage — see exactly how Stacktora stacks up against doing it by hand, docker init, Dev Containers, and cloud IDEs, row by row.

Clean URLs across the entire site — no more .html cluttering the address bar.

Admin dashboard now tracks GitHub and Google sign-ins as first-class metrics.

A proper 404 page — because a broken link shouldn't feel like leaving the building.

stacktora plan — see the exact line-by-line diff of what a sync would change before it changes anything. Plus stacktora doctor, which checks for the usual local setup problems (Docker not running, port conflicts, missing .env values) in one command. Add --json to either — or to check — for structured output built for CI pipelines and AI agents.

Know where a secret actually lives. Add a source note to any environment variable (e.g. "1Password · Acme · Stripe") and Stacktora prints it as a comment right above the variable in your generated files — no more hunting through Slack for the real value.

Deploy to Fly.io. A second path to production alongside Kubernetes — toggle it on and get a real fly.toml plus a README with the exact commands to attach whatever datastores you picked. It's honest about what Fly actually does: deploys your app container, not a full multi-service stack.

stacktora status — live container health straight from docker compose ps, right in your terminal. Add --json here too, same as check, plan, and doctor.

Real formatter config, not just a choice. Set tools.codeStyle (semicolons, quotes, line width) and get an actual .prettierrc.json generated to match — instead of just picking Prettier and hoping the defaults are what you wanted.

stacktora recipes and stacktora install <id> — the same curated stacks from the templates gallery, straight from the terminal, with correct runtime-specific defaults (package manager, linter, formatter, port) applied automatically.

Bring your own recipes. Drop a JSON file in .stacktora/recipes/ and it shows up in stacktora recipes, ahead of the bundled ones — commit one to a repo and every teammate gets your org's standard stack with stacktora install.

stacktora audit — enforce a company.stacktora.json policy (allowed runtimes, required tooling, banned datastores) against the local recipe. No server, no account — just a file committed next to your stacktora.json.

The recipe marketplace, opened up. Add --remote to stacktora recipes or install to reach the public registry at stacktora.com/registry — fully opt-in, nothing about the CLI's offline defaults changes unless you ask for it.

Refreshed brand assets across the site — new logo and wordmark files, all resized responsibly so nothing stretches or pixelates at any screen size.

Always know what you're building. A persistent summary now sits right under the stack bar while you work — runtime, every datastore and service, plus your web or mobile client, all by name. No more clicking into a popover just to remember what you've already picked.

Fixed the brand typeface specimen cards on the Press page cutting off on narrow phone screens.

Closed out a handful of leftover English strings in the wizard — search boxes, a few form labels, the GitHub push dialog — so every one of the 14 languages now sees a fully translated interface, not just most of it.

stacktora audit has more teeth. company.stacktora.json now also supports allowlisting datastores and services (not just banning them), requiring a source note on every secret, and requiring specific output files to be enabled — on top of the runtime, tooling, and health-gate checks it already had.

Size your deployment, not just choose one. An optional config.resources field (cores and megabytes) now sizes both the Kubernetes and Fly.io outputs consistently — real requests/limits on the K8s app container, a matching Fly VM size and memory. Leave it out and both keep exactly the defaults they had before.

Real editor autocomplete for stacktora.json. Every generated recipe now includes a $schema field pointing at a published JSON Schema — most editors pick it up automatically, catching an invalid datastore id or a typo'd field before you ever run stacktora sync.

A GitHub Action that reads stacktora.json natively — no CLI install required. stacktora/audit-action validates a project's recipe against the published schema and, if present, its company.stacktora.json policy, right in your existing CI. Add uses: stacktora/audit-action@v1 to a workflow and every pull request gets checked automatically.

Live company-policy validation, right in the editor. stacktora-vscode checks any open stacktora.json against a company.stacktora.json as you type — inline warnings on the exact field that's wrong, plus a status bar compliance summary. No policy file in the workspace means it stays silent, same as the CLI.

The recipe registry now runs on a real backend. stacktora.com/registry is served from a database instead of a hand-edited file, with an admin review queue behind the scenes — same --remote flags on recipes and install, no changes needed on your end.

The Vault — browse the registry like a real gallery. stacktora.com/vault is a proper browsable page for community recipes — search, categories, a real detail view per recipe with the exact install command — instead of a raw JSON file. The CLI's --remote contract at stacktora.com/registry is completely unchanged underneath; this is purely a new, human-facing surface on the same data.

Public recipe submissions are open. Any signed-in account can propose a recipe at stacktora.com/submit — it lands as pending review and shows up in the Vault once approved. Track your own submissions right on that page.

The Vault now has 18 real, verified recipes across a dozen categories — AI/ML, e-commerce, real-time, fintech, observability, analytics, content, DevOps, and more. Every one is schema-validated and run through the actual CLI's generator before it ships, not just reviewed.

Every modal and the settings drawer now sit over a softly blurred backdrop instead of a flat dark overlay.

Fixed scroll-lock behind modals on iOS and in-app browsers like X's — the old approach quietly failed to block background scrolling on exactly those, now using the technique that actually works there. Also fixed a mobile bug where the Settings drawer's Save button could sit just below the visible screen.

The Admin and Submit pages now share the app's own header pattern — a sticky, blurred bar with the logo flush left and page-relevant actions on the right, instead of a boxed-in header confined to the content width.

The Vault has its own branded header logo, distinct from the rest of the site, without duplicating the mark twice on the page.

Two-factor authentication. Turn it on from Account settings — scan the code into any authenticator app (Google Authenticator, 1Password, Authy, etc.), and you'll be asked for a 6-digit code on top of your password at sign-in. Ten one-time backup codes are generated in case you ever lose your device. See stacktora.com/security for the full detail on how it's implemented.

Optional public usernames for Vault credit. Set one in Account settings and your approved Vault submissions show "by @you" — entirely opt-in, and anonymous submission stays the default. Clear it anytime to go back to anonymous.

The Manifesto. A statement of what we actually believe about developer environments, trust, and why Stacktora is built the way it is — stacktora.com/manifesto.

Workspace member management now actually works. Removing a member or changing someone's role used to only update your own browser — the person kept their real access regardless. Both now make a real change on the server. Also added the ability to cancel a pending invite instead of waiting for it to expire, and seat limits (10 on Team, 30 on Growth) are now genuinely enforced rather than just stated.

If you've set a public username, it now shows right under your email in the account menu and Settings — a quick reminder of what's showing on your Vault submissions.

LinkedIn, X, and GitHub handles in Account settings. Paste a full profile link or just the handle — we clean it up either way. These are stored as plain handles, never a clickable link out — the first piece of what could become a real public profile down the road.

Sign in with GitHub or Google — no password required.

Workspace invites — bring your team in, and they inherit the exact same stack.

Growth plan ($199/mo, 30 seats) for larger teams.

11 language localizations for the app itself.

Live Preview — every generated file updates as you configure, before you download anything.

Admin dashboard with live revenue and usage metrics.

Published to npm as stacktora — npx stacktora sync keeps your environment in sync from the terminal, fully offline, no account needed.