Built this week, on the job.

Every form field in the app and on the marketing site is now properly labelled for assistive tech, so a screen reader announces it and clicking the label focuses it. Sign-up and login fields carry autocomplete too, so your password manager fills and saves them. Standard, overdue, done.

A sign-up or request-access form that trips validation no longer wipes itself — your name, company and email come back so you fix the one field that was wrong, not all of them. The password is never echoed back.

A CSV export cell that began with =, +, - or @ is now prefixed so Excel and Sheets treat it as text, not a formula. Lead data comes from a public form, so this closes the path where a crafted entry could run when you open the file.

Opt-in AI inside the flows you use: a daily-log note becomes its trades and inspections, a pasted invoice lands as the actual on the line you pick, a new line gets a band suggested from your own priced history, a document answers a question from its own text, and the week’s client-visible log drafts a homeowner update you review before sending. Off until you add a key; your numbers, your call — no chatbot bolted on.

A per-company daily limit on AI calls, with today’s usage shown in Settings. Over the cap the AI pauses for the day — the app never does. No surprise bills.

A public signup mints your workspace with no invite code and drops you into a fully-worked sample job, then nudges you to price your own first one. Every marketing button now goes straight to it.

While you price a line, its typical actual, band and hit rate from past jobs show right there — and a Suggest-a-band button proposes a low–high from your own history. Paste a whole estimate from a spreadsheet and it structures into lines.

A negative bid or actual once slipped past validation and pulled the verdict math negative. Costs and bids are non-negative by construction now; change-order credits stay signed on purpose.

Indexed every project- and company-scoped lookup and de-duplicated the per-request access checks, so the app stays quick as the database grows.

The document viewer now renders in a locked-down sandboxed frame, and imported checklist HTML is run through an allowlist sanitizer. A malicious seed file can no longer script against the app.

Production now refuses to run without a real session secret, the dev auth bypass is ignored in production, first-run setup is token-gated, and changing your password invalidates every other session.

A real automated test suite now covers the role/permission matrix, the band→actual→verdict math, and the money gates. Nothing merges without it green.

Roof panels nearly slipped through plan review. Order-by dates now derive from the schedule and get loud two days out.

The $200–400 floor-sealer line rendered its dot outside the track. Sub-$1k lines now scale correctly.

PRODUCT

COMPARE

RESOURCES

COMPANY

LEGAL