| Collab | Real-time co-editing on the screenplayYounus: Yjs + Hocuspocus + TipTap, own collab-server service | done |
| V11 | Every paid tier was free — two waysself-upgrade via settings + no expiry check; both closed | done |
| V11 | FIB (First Iraqi Bank) wiredcallback treated as notification, status re-fetched from the API | done |
| V11 | Subscription admin in the owner dashboardclaimed vs entitled, grant/extend/revoke | done |
| V11 | Admin stopped inventing data on API failurean outage rendered fake org counts badged 'Demo' | done |
| V10 | End-to-end suite (there were none)19 specs, real backend, blocking in CI | done |
| V10 | Script save could silently wipe the screenplayfound by the E2E suite on its first run | done |
| V10 | Workspace search built for realsearches the script TEXT, not just metadata | done |
| V10 | Lint 279 errors -> 0, now blockingwas hiding a cross-project write bug | done |
| V9 | Password reset was a dead end reporting successthe only recovery path | done |
| V9 | Fake checkout deletedtook card+CVC, charged nobody | done |
| V9 | Admin bypass removed from the bundleverified absent from dist/ | done |
| V8 | Crew create broken two ways at oncedead button + backend 400 | done |
| V8 | Phone verification built end to endOTPIQ behind an interface | done |
| V7 | Security pass: 18 findingsstored XSS, unauth DoS, CSP | done |
| Ops | Deploy the collab-server servicenew: Hocuspocus WS + COLLAB_* env vars, not deployed yet | planned |
| Scale | Shared (Redis) rate limiterper-worker today: looser, not incorrect | planned |
| Product | RBAC read enforcement built but OFFenabling would cut Talent off mid-shoot | planned |
| V11 | Any org admin could grant itself the top paid tier | fixed |
| V11 | A paid plan never expired — pay once, keep forever | fixed |
| V11 | FIB callback body could have been trusted to mark paid | fixed by design |
| V10 | Malformed script save wiped the screenplay, returned 200 | fixed |
| V10 | Cross-project write via a stale React closure | fixed |
| V9 | Password reset dead end reported success | fixed |
| V9 | Admin session for any email in mock mode | fixed |
| V9 | Unset APP_ENV disarmed every production guard | fixed |
| V7 | Stored XSS in the screenplay editor | fixed |
| V6 | Live Gmail credential in git | code fixed / ROTATION STILL OUTSTANDING |