Back to PermitCore

Changelog

What's new in PermitCore, newest first.

June 2026

v0.9 — SSO, Resellers & Public Storefront Redesign

  • New Per-tenant SSO — OAuth 2.0 (Google, Microsoft, GitHub) and SAML 2.0
  • New Reseller system — resellers can sell license packs with margin tracking
  • New Metered billing — usage-based activation pricing via Stripe meters
  • New License bundles — sell multiple licenses as a single purchase
  • Improved Complete public storefront redesign with zero-knowledge showcase, interactive feature modals, trust signals section
  • Improved Full legal pages: Terms, Privacy, DPA, Security, Cookies
  • Fix Domain migrated to permitcore.dev
  • Security All 17 security audit findings resolved (JWT expiry, auth headers, CORS, rate limiting)

May 2026

v0.8 — License Store, Stripe & Analytics

  • New White-label License Store with Stripe checkout — sell directly to your customers
  • New Store customer portal — customers can view and manage their own licenses
  • New Stripe billing integration — subscription management, plan upgrades, invoices
  • New Analytics dashboard — activation heatmap, geographic breakdown, daily/weekly trends
  • New Webhook system — send real-time events to your endpoints, signed with HMAC-SHA256
  • New Custom license fields — attach arbitrary key-value metadata to any license
  • New Geographic restrictions — restrict license activation to specified countries
  • New Device fingerprinting — tie activations to specific machines
  • Improved Billing tier enforcement via activation pool (MaxTotalActivations)

April 2026

v0.7 — Offline Activation & MFA

  • New Offline activation — ECDSA P-256 signed tokens for air-gapped environments
  • New TOTP multi-factor authentication for all admin accounts
  • New MFA backup codes with secure one-time use
  • New GDPR tools — full data export (Art. 15/20) from admin settings; account deletion (Art. 17) handled on request
  • Improved Audit log now records IP address, user agent, and field-level diffs for updates

March 2026

v0.6 — Zero-Knowledge Encryption & Public API

  • New AES-256-GCM client-side encryption — plaintext keys are never stored
  • New PBKDF2 key derivation with 600,000 iterations and per-tenant salt
  • New Public validation API — POST /api/v1/validate
  • New Public activation API — POST /api/v1/activate with atomic counter enforcement
  • New HMAC-SHA256 lookup hashing — the stored value can't be used to verify key guesses without the server's secret
  • New Rate limiting — per-IP (60 req/min on public API) and per-tenant billing tier limits

February 2026

v0.5 — Core Platform Launch

  • New Multi-tenant architecture — full data isolation between companies
  • New Argon2id password hashing with per-user salt
  • New JWT authentication with role-based access control (SuperAdmin, CompanyAdmin, CompanyUser)
  • New Product and license key management
  • New Billing tiers: Free, Starter, Professional, Enterprise
  • New Installation wizard — one-command Docker deploy
  • New Blazor WebAssembly admin panel