What shipped, and why

Fifteen pages on one shared shell, replacing seven pages that each carried their own copy of the same stylesheet. The practical effect is that the navigation, the footer and the type scale are now defined once instead of seven times, and can no longer drift apart.

• New pages: product, showcase, docs, changelog, contact, security, about.
• The workspace moved to its own document, so a first-time visitor no longer downloads the entire app runtime to read the home page.
• A moving 3D field behind every page, drawn in WebGL. It switches itself off on low-end hardware, on reduced-motion, and in a background tab.
• Every dead href="#" in the footer is gone — the links either go somewhere real now or were removed.

The axis labels on the equity and drawdown charts were drawn at 24% opacity over black — about 1.8:1 contrast, well under the 4.5:1 accessibility floor for text that size. Gridlines were at 2.5%, which is to say invisible. You could not read a value off your own results.

Fixed at both ends. While in there: the "backend offline" toast had been appearing directly on top of the composer's send button, covering the primary action at the exact moment something had gone wrong.

New HTML was being served alongside cached JavaScript from a previous deploy, and the mismatch surfaced as raw translation keys on the live site. Asset URLs now carry a content hash, so a changed file always gets a fresh URL and an unchanged one stays cached.

The signed-in home page was mostly a marketing banner aimed at people who had already signed up. It now opens on your actual numbers — tests run, best result, saved plans — with starter ideas for anyone staring at an empty box.

Settings was rebuilt at the same time, from a cramped modal into a real two-pane page with appearance, language and usage.

There were two places to start a backtest, with different settings and different behaviour, and which one you got depended on how you had navigated. There is now one.

Also added: a microphone button. Speech is transcribed by your browser's own API, so no audio is uploaded anywhere.

Ticker, capital and date range were read from hidden form fields that no interface could edit. Every backtest anyone ran was silently using AAPL, $100,000 and 2020–2024, no matter what they thought they had configured. The label under the composer is now a button that opens the real editor.

This one had been live for a while, and it made a lot of results quietly meaningless.

Clicking a reset link signed you straight in with your old password still active, and never offered a field to set a new one. Now the reset event opens a proper set-a-new-password view before anything else happens.

Two more in the same pass: the live trade table crashed on any trade with a missing price, and comparison mode was plotting every run against array position rather than calendar date — which squashed shorter runs to the left and made them look better than they were.

The local development server would happily hand out .env — including API keys — to anything on the same network, and allowed path traversal out of the project directory. It now binds to localhost only, refuses dotfiles, and rejects traversal.

Never reachable from the live site, but a bad enough class of bug to write down publicly rather than fix quietly.

Until now every result was simulated. Strategies are now generated as real backtesting.py code and executed against actual daily bars from Yahoo Finance, in a sandboxed process.

When the executor is unreachable, reports fall back to sample data and say so on the report. Showing simulated numbers while implying they are real is the one failure mode this product cannot have.