Changelog

What changed and when

A running log of updates to the OpenAI Club at UT Dallas platform, grouped by day.

Tuesday, August 18, 2026

  • feat(member): new nav, pfp compression, AI mentor toggle, Auth0 GitHub
  • fix(member-nav): more popover now opens
  • feat(security): implement 12-layer anti-spam, anti-troll protection system
  • fix(security): patch 3 holes found in pen testing
  • fix(security): patch DevTools + CORS holes
  • feat(security): add server-side auth guards + bot detection
  • fix(member-nav): widen More dropdown, stop header text overlap
  • fix(security): correct 3 real bugs from the last security pass
  • fix(profile): add missing "use client" directive
  • Ship landing page refresh and auth/hardening updates.
  • Fix unnecessary escape characters in security regexes.
  • Make the navbar notification bell an auth-aware popover.
  • Harden security posture for production.
  • Harden API and portal surface.

Monday, August 17, 2026

  • feat(site): protect member areas and refresh hero
  • feat(site): add persistent transparent navigation
  • fix(security): close privilege escalation and public data exposure
  • feat(portal): guided tour of member portal for new registrations
  • feat(ui): spread underused animation kits across more surfaces
  • fix(cms): resolve branded admin logo import
  • fix(security): use field-level access for privilege escalation prevention
  • feat(ui): register form enhancements and visual refinements
  • User edits: landing page copy, animation timing, force-dynamic CMS frontend
  • feat(animations): fresh motion for admin, officer, member, and CMS portals
  • fix(cms): use Payload custom.scss for admin animations
  • feat(ui): add ActionButton component for consistent CTAs
  • fix(cms): allow cross-origin requests from production domain and localhost
  • feat(cms): polish admin cards, labels, lists, and dashboard
  • fix(cms): start even when Nodemailer transport is unreachable
  • feat(legal): add bylaws, privacy, and user usage agreement pages
  • feat(legal): add bylaws, privacy, and user usage agreement pages
  • feat(bylaws): link to official OUATD_Constitution.pdf

Sunday, August 16, 2026

  • feat(site): shared nav, 11 new pages, motion, a11y
  • feat(site): live data, motion primitives, admin dashboard

Saturday, August 15, 2026

  • feat: public landing, member portal stats, leaderboard, and events pages
  • feat(officer): QR check-in scanner with manual entry fallback (closes #28)
  • feat(profile): member profile editor (closes #29)
  • feat(officer): analytics dashboard with charts (closes #30)
  • feat(polls): poll voting UI with live results (closes #31)
  • feat(kudos): kudos sending UI (closes #32)
  • feat(referrals): referral link sharing UI and registration attribution (closes #33)
  • feat(missions): mission claim UI (closes #34)
  • feat(apply): membership application form (closes #35)
  • feat(auth): email verification and password reset pages (closes #36)
  • feat(projects): project showcase and contribution submission (closes #37)
  • feat(officer): mobile view for check-in and point awards (closes #42)
  • feat(certificates): downloadable digital badge certificates (closes #79)
  • feat(voting): member-generated content voting for project of the month (closes #80)
  • feat(stats): attendance heatmap and personal stats page (closes #81)
  • feat(matching): AI-powered project matching based on interests (closes #82)
  • feat(mentor): LLM mentor Q&A for members (closes #83)
  • feat(polls): live event polls projected on screen (closes #84)
  • feat(store): rewards store UI where points unlock perks (closes #85)
  • feat(pwa): installable mobile app wrapper (closes #86)
  • feat(demo): OpenAI API integration for workshop demos (closes #87)
  • feat(portfolio): resume/portfolio builder for members (closes #88)
  • feat(alumni): alumni network tracking and mentor requests (closes #89)
  • feat(achievements): club-wide achievements timeline (closes #90)
  • fix(security): rate limit AI endpoints to prevent cost abuse
  • fix(security): remove unnecessary overrideAccess from public read routes
  • fix(types): replace ad-hoc user casts with generated User type

Thursday, August 13, 2026

  • clean: remove unused error bindings and backend lint noise
  • feat: aggregate engagement report and add notification/leaderboard tests
  • feat: officer nomination form for special awards
  • clean: remove explicit any from tests and backend src
  • feat: Slack/Discord announcements integration
  • feat: weekly member recap cron
  • feat: social share cards for rank, badge, and event
  • clean: fix a11y labels in login form
  • feat: engagement backend (progress, rank, mini leaderboards, milestones, member-of-month)
  • feat: house/team competitions with team points leaderboard
  • feat: event photo gallery with member tags
  • feat: attendance bingo and event scavenger hunt
  • feat: project demos with member voting
  • feat: ask-me-anything queue for guest speakers
  • feat: AI/ML study group matching and member spotlights
  • feat: workshop quizzes and AR QR scavenger hunt
  • feat: points store, PWA, social bot, and referral leaderboard
  • feat: secret achievements, attendance lottery, and personal recap
  • feat: portfolio builder, mentorship, and campaigns
  • feat: ai summaries, per-event quizzes, team points, and battle passes
  • docs: README and AGENTS.md with build, test, and feature notes

Wednesday, August 12, 2026

  • [Backend] Fix DB adapter mismatch and establish migration workflow
  • [Backend] Replace sessionStorage JWT with httpOnly cookie auth
  • [Backend] Complete email verification, password reset, and SMTP flow
  • [Backend] Implement membership application approval workflow
  • [Backend] Add event registration capacity, waitlist, and cancellation API
  • [Backend] Build member profile self-service API
  • [Backend] Add officer member management API
  • [Backend] Add event and announcement email notifications
  • [Backend] Migrate media storage to R2/S3-compatible object storage
  • [Backend] Add rate limiting, abuse prevention, and audit logging
  • [Backend] Add CMS integration tests and CI
  • [Backend] Add health check and environment validation
  • [Backend] Member participation points and leaderboard
  • [Backend] Add achievement badges
  • [Backend] Add event attendance streaks
  • [Backend] Add member levels and tiers
  • [Backend] Add event polls and quizzes
  • [Backend] Project contributions and peer recognition
  • [Backend] Add referral and invite tracking
  • [Backend] Add weekly missions and challenges
  • [Backend] Gamified QR check-in for events
  • [Backend] Admin engagement analytics dashboard API
  • [Backend] Remove as any casts and improve payload data typing
  • [Backend] Ignore tsbuildinfo artifacts
  • [Backend] Add Redis-backed rate limiting and analytics cache
  • [Backend] Skip env validation during Payload generate commands
  • [Backend] Add migration for Projects.status enum change
  • [Backend] Wire cron endpoints to Vercel Cron scheduler
  • [Backend] Add integration and unit tests
  • [Backend] Rename middleware.ts to proxy.ts
  • [Docs] Rewrite README and add FEATURES.md
  • [Docs] Expand FEATURES.md with additional engagement ideas
  • [Frontend/Backend] Conditional special pages with admin toggle
  • [Security] Configure auth cookie SameSite and Secure (CWE-1275, CWE-614)
  • [Security] Tighten login rate limiting and document lockout (CWE-307, CWE-770)
  • [Security] Harden password policy and add breach detection (CWE-521, CWE-307)
  • [Security] Add command/code injection static audit (CWE-77, CWE-94)
  • [Security] Redact PII and secrets in logs (CWE-209, CWE-200)
  • [Security] Reject wildcard CORS/CSRF origins in env validation (CWE-942, CWE-306)
  • [Security] Validate redirects and internal paths (CWE-601)
  • [Security] Restrict uploads and sanitize filenames (CWE-434, CWE-22)
  • [Security] Sign QR check-in tokens with HMAC (CWE-327, CWE-345)
  • [Security] Atomic points, streak and level updates (CWE-362)
  • [Security] Add request body size limit in proxy (CWE-770, CWE-400)
  • [Security] Add centralized audit logging and make point awards atomic (CWE-778)
  • [Security] Enforce role and status privilege boundaries (CWE-269, CWE-285)
  • [Security] Prevent IDOR in member-owned collections (CWE-639, CWE-862)
  • [Security] Harden ids against NoSQL injection (CWE-943, CWE-89)
  • [Security] Escape user-generated HTML in emails and public outputs (CWE-79, CWE-80)
  • [Security] Add origin CSRF check to state-changing API requests (CWE-352)
  • [Security] Document and configure encryption at rest (CWE-311, CWE-312)
  • [Security] Add anomaly detection cron for admin actions (CWE-285)
  • [Security] Data retention and member deletion workflow (CWE-922)
  • [Security] Validate and sanitize API request bodies (CWE-20, CWE-117)
  • [Security] Add optional signed admin API requests with nonce+timestamp (CWE-345)
  • [Security] Add TOTP MFA for admin and officer accounts (CWE-287, CWE-308)
  • [Security] Backend API fuzzing harness
  • [UI] Global skeleton component catalog and page loading state
  • Add changelog page, audit log page, and CHANGELOG.md
  • [Security] Implement Content Security Policy and security headers (CWE-693)
  • [Security] Prevent clickjacking and UI redressing (CWE-1021)
  • [Security] Add edge security headers and WAF guidance (CWE-693)
  • [Security] Enforce HTTPS in production and validate certificates (CWE-319, CWE-295)
  • [Security] Audit and remove hardcoded credentials (CWE-798)
  • [Ops] Add dependency scanning and SAST to CI (CWE-1035, CWE-1104)
  • [Ops] Pin dependency versions and lock packages (CWE-1104)
  • [Ops] OWASP ASVS review and penetration test plan
  • Restrict auth to @utdallas.edu emails
  • Merge pull request #23 from OpenAI-UTD/dev
  • feat(leaderboard): add SSE endpoint for real-time leaderboard updates (#38)
  • feat(notifications): add member notification feed collection and API (#39)
  • feat(push): add Web Push backend for event reminder notifications (#40)
  • docs: mark member QR check-in as implemented (#41)
  • feat(reports): add attendance and engagement export endpoint (#43)
  • feat(milestones): add milestone notifications for tier, level, streak, badge (#44)
  • fix: security and correctness issues in notifications, push, leaderboard and analytics
  • feat: weekly wrap-up email cron (closes #45)
  • Merge dev into main

Tuesday, August 11, 2026

  • Initialize OpenAI UTD club website
  • Add reusable club site components
  • Add club content foundations
  • Add club member platform foundation
  • migration 4