🌿  Build Update #2

A lot happened
in just a few days.

Hi,

A quick note before we dive in — you’re receiving this because you opted in to Nooksplore — Build Updates, our behind-the-scenes list for people who want to follow along as we build. Your waitlist spot is completely separate and still has one job: we’ll email you when we launch with your free guide. That’s it, and that’s a promise.

If you’d like to adjust which lists you’re on at any time, manage your subscription preferences here.

Now — it’s been a busy few days in the lab. Here’s everything that shipped, organized by what it means for you as a user, and what’s gone into the foundation underneath.

---

✦  User Features

🔐 Username login You can now sign in with your name or email — case-insensitive. Display names are unique across all accounts.

📄 Guide previews overhauled View and Preview now render guides in full — proper headings, bold text, links — exactly matching how they look when first generated. No more raw text dumps.

🖨️ Print Guide Available in both My Guides and the Admin panel. A dedicated print layout hides QR codes during normal viewing — they only appear when you actually print. The physical guide experience is starting to take shape.

📍 Smart map links Every address and map link in a guide is now clickable. On iOS it opens Apple Maps; everywhere else, Google Maps. One tap to navigate — exactly as promised.

📱 Mobile admin The admin sidebar and tables now scroll horizontally on mobile instead of squishing into an unusable mess.

👤 Admin user management The edit user screen now shows daily and monthly guide quota usage per user, with the ability to grant additional guides directly from the admin panel.

✦ Logo finalized All three SVG logo variants (standard, light, dark) have been converted from font-dependent text to permanently outlined vector paths. The Nooksplore wordmark is now baked in — it renders correctly everywhere, no font loading required.

---

✅  Vera Gets Smarter

Vera — The Fact-Checker just got a major upgrade. She now treats OpenStreetMap and official websites as primary sources, which means her verifications are more accurate and more reliable. Sites like Google Maps that actively block bots no longer cause false verification failures — Vera now knows to route around them rather than flag a place as unverified. Your guides just got cleaner.

---

🔒  Security

We've put significant work into the security foundation this week. Here's exactly what's in place:

Authentication Argon2ID password hashing · HttpOnly + SameSite=Strict session cookies · Session ID regenerated on every login · Remember-me tokens with expiration · Account lockout after 5 failed attempts (15 min cooldown)

Access Control Role-based auth (admin / beta-user / user) · Ownership verification on all resource modifications · Invite-only registration with configurable roles · Maintenance mode with admin bypass

Forms & Input CSRF tokens on every POST · Prepared statements everywhere (no SQL injection surface) · Output escaping on all fields (no XSS surface) · Open redirect prevention · Input whitelisting on role and status fields

Rate Limiting Daily and monthly guide generation limits per role · API endpoint rate limiting (5 req/hr per IP) · Password reset rate limiting via token expiration

Encryption & Tokens AES-256-CBC for stored credentials, key stored outside web root · Cryptographically secure random tokens for password resets, share links, and invite codes · Databases stored outside web root and not externally accessible

Audit Trail Every significant action is logged with user, IP, user agent, and timestamp — viewable in the admin panel with filtering.

---

○  What's Still To Do

Being straight with you, as always. Still on the list:

○  HTTP security headers — X-Frame-Options, CSP, HSTS. A quick Apache config win, coming soon.

○  Session inactivity timeout — not yet implemented

○  Two-factor authentication — on the roadmap

○  Payments — not started yet

○  User accounts (public) — not started yet

---

That’s the week. More to come — and if you know someone who’d enjoy following a product being built in the open, send them to nooksplore.com. 🙏

You’re on the Nooksplore — Build Updates list. Your waitlist spot is separate and untouched.
Manage your subscription preferences