Every improvement, in order.

Embeddable widgets + rank API

• FeatureEmbeddable leaderboard widget at /embed: drop a live mini-board on any external site with one snippet — configurable limit, category, time window (all-time / 24h / daily), and auto, light, or dark theme.
• FeaturePer-listing rank badges: badge format plus a new GET /api/rank lookup (by id, slug, or URL) returning the listing, its all-time rank, and sibling totals — show off rank anywhere.
• FeatureSelf-serve /widgets docs page: interactive configurator with live preview, one-line JS snippet, and an iframe fallback for restrictive CMS embeds.

Sponsor ad board + hero variations

• FeatureSponsor ad board: hero-side rail slots with per-slot daily/weekly/monthly pricing and cheapest-combination quotes up to 90 days — a second revenue stream independent from pay-to-rank.
• FeatureSelf-serve ad booking: booking modal plus /api/ads routes (spots, quote, checkout, active), with signature-verified webhooks and zero-key sandbox mode through the new purchaseType passthrough.
• FeatureSponsored cards render with rel="sponsored" for clean link equity; empty slots show a quiet ghost upsell instead of shouting dashed boxes.
• Feature2 switchable hero variations — Jackpot and Race — via one hero.variation line (or NEXT_PUBLIC_HERO_VARIATION), with a dev-only /hero-lab preview page.
• FeatureDense leaderboard table for rank 4+ (site, total, to-outbid, bids, launched) under the podium cards, plus a reusable SiteHeader with live stats, presence count, search, and its own bid modal.

SEO pages + themes + central SEO config

• FeatureEvery paid listing now gets its own indexable page at /listings/[category]/[slug] — rank badge, bid stats, bid history, share links, and a related-listings block, revalidated hourly.
• FeatureSearch-ready metadata out of the box: canonical URLs, Open Graph tags, Product + Breadcrumb + FAQ JSON-LD, plus a /listings index, auto-generated sitemap, and robots rules.
• FeatureThin-content guard: listings with no snapshot and short descriptions get noindex, follow — they pass link equity without dragging down rankings. Toggle it in one flag.
• FeatureNew one-file seo.config.ts: title templates, description length, JSON-LD toggles, sitemap priorities, and header/footer discovery links — no code changes to tune SEO.
• Feature4 switchable themes — clay, ocean, honey, forest — with light/dark CSS variables. Change the whole look with a single THEME env line.

Bid calculator fix

• FixThe bid modal's price calculator no longer sticks on “Calculating…”. The calculation now re-runs every time the modal opens (it previously ran only on page load, so the pay button never resolved on first open).

Security hardening pass

• SecurityRace-safe webhook idempotency: concurrent duplicate deliveries now resolve to “already recorded” via the unique payment constraint instead of erroring into provider retry storms. Applied to all four webhook routes (Stripe, Dodo, Razorpay, generic).
• SecurityError messages no longer leak internals: webhook and checkout failures return generic messages while details go to server logs.
• SecurityProvider configuration is no longer public: GET /api/checkout no longer exposes per-provider setup flags.
• SecurityDestructive seed route is fail-closed: /api/dev/seed now requires ENABLE_DEV_SEED=true even outside production, so a staging deploy can never be wiped by an unauthenticated request.
• SecuritySpoof-resistant rate limiting: client IP prefers x-real-ip over the spoofable end of X-Forwarded-For, and buckets are pruned and capped against memory-exhaustion attacks.
• SecurityDNS-level SSRF protection: scraped hostnames are DNS-resolved and re-checked against the private-IP blocklist before fetching and after redirects.
• FeatureDocumented security model in the README: webhook verification, sandbox gates, SSRF design, and rate limits.

Initial release

• FeaturePay-to-rank bidding engine with atomic, race-safe transactions and cumulative-total ranking.
• FeatureThree leaderboards from one payment: All-Time, rolling 24H, and Daily UTC archives.
• FeatureLive activity ticker, KPI stats bar, category filters, and confetti on paid bids.
• FeatureSSRF-hardened OpenGraph scraper: paste any URL or @handle for instant listing autofill.
• FeatureStripe, Dodo, and Razorpay webhooks with signature verification, plus a zero-key sandbox mode.
• FeatureSQLite by default with a one-line switch to Postgres; seed script included.
• FeatureOne-file rebrand (name, currency, rules, categories, FAQ) in the warm paper theme with the BidKit mark.