After Action
Free Readiness Check
Changelog

Everything we've
shipped.

Every feature, fix, and trust improvement. Released continuously. No marketing gloss — these are the actual commits.

Public lead-gen funnel + trust surface

17 entries  ·  7 features  ·  7 fixes  ·  3 trust

  1. FEAT

    Free 2-minute Readiness Check

    8-question cyber readiness preview with instant scoring across the NIST 800-61 capability areas. No signup. Share results on LinkedIn/X with one click or email the breakdown to any address. Feeds directly into the ops leads pipeline with source tracking.

  2. FEAT

    Whitepaper library

    Five methodology disclosures published at /whitepapers: Readiness Score Methodology, Mispriced Risk, FAIR Risk Quantification, AAR Auto-Drafting, and Decision Analytics. Markdown-rendered with per-whitepaper Open Graph cards and TechArticle JSON-LD.

  3. FEAT

    Public trust pages

    /about (founder + principles), /security (8 controls + compliance posture), /privacy (GDPR-aware policy). Linked from the homepage footer and cross-referenced from the whitepaper and readiness-check pages.

  4. FEAT

    Ops visibility: email sequences + suppressions

    Two new internal monitoring pages track enrollment status (active, completed, unsubscribed, failed) and the blocked email list (hard bounces, complaints, unsubscribes). Wired into the ops sidebar nav.

  5. FEAT

    Leads page source filter

    Source filter chips and a "self-serve (mo)" stat card track which funnels are producing. Ops dashboard also gained a clickable "new leads (7d)" stat that routes to the pipeline.

  6. FEAT

    Email unsubscribe flow

    HMAC-signed one-click unsubscribe link in every sequence email. Clicking cascades into the email_suppressions table so no future transactional mail hits that address. Honors RFC 8058 one-click POST.

  7. FEAT

    Exercise request notification

    When a client submits a self-service exercise request from the scenario library, a notification email now fires to ops automatically. Client flow was working; visibility was the missing piece.

  8. FIX

    Docs site unreadable

    Every API doc and authentication reference was rendering white text on white background — the docs layout was designed for dark mode but wrapped in bg-white. Full migration to light theme, prose classes retuned for gray-900 headings and gray-700 body.

  9. FIX

    Checkout flow invisible headlines

    The Stripe checkout page and success page had "Review Your Order" and "Payment Confirmed" set to text-white on a bg-white wrapper — invisible to every paying customer. Restored the intended dark theme.

  10. FIX

    Signup and reset-password white-on-white

    Both auth pages used legacy dark-theme tokens (text-white, bg-surface-container) inside a light wrapper. Headlines and input values were invisible. Rewrote on the design system with proper contrast and RHF validation.

  11. FIX

    Password recovery flow completely broken

    Neither /auth/callback nor /update-password existed. Users who clicked the reset-email link got 404s. Built both routes with open-redirect protection and added them to the stealth-gate exemption list.

  12. FIX

    Pricing page CTAs bypassed checkout

    Engagement tier "Get Started" buttons routed to /contact instead of /checkout?plan={tierId}. Self-serve Stripe payment was unreachable from the pricing page. Annual programs still route to /contact since they need scoping.

  13. FIX

    Facilitator control room hex literals

    Three text-[#0a0f1a] hardcoded colors replaced with text-gray-900. Design system compliance.

  14. FIX

    Contact form validation

    Migrated to react-hook-form + zod with inline error messages, proper htmlFor labels, and aria-invalid wiring.

  15. TRUST

    JSON-LD structured data

    Organization schema in the root layout (name, logo, founder, contact points). TechArticle schema per whitepaper. Enables Google Knowledge Graph and LinkedIn article previews.

  16. TRUST

    Dynamic Open Graph images

    Edge-rendered 1200x630 social cards for /whitepapers/[slug], /about, and /readiness-check. LinkedIn and X shares now render distinct cards instead of a generic brand image.

  17. TRUST

    sitemap.xml and robots.txt

    Public lead-gen surfaces now indexed. /app/*, /api/*, and auth routes explicitly disallowed for crawlers.

See where your program stands

2 minutes. 8 questions. No signup.

Take the readiness checkRead the methodology