🐛 Bug Fixes & Security Patch
🐛 Fixed
- Logout auth cleanup — fixed session cleanup issues during logout flow
- XSS vulnerabilities in generate.js — proper escaping added to prevent injection attacks
🔧 Changed
- Auth flow hardened — deployment blockers resolved for smoother releases
- CI E2E test selection fixed — proper test discovery and execution
- CI coverage diff script tracking fixed — accurate coverage reporting
- Pipeline documentation updated — test counts and structure documented
- Pre-commit hook enhanced — self-check mode added for validation
- Backend routes formatted — Ruff linting applied across all route files
🛡️ Security Hardening, Performance & UX Improvements
✨ Added
- JWT token type guard — explicit rejection of password_reset tokens in auth flow
- Enhanced PII redaction — proactive redaction in generate routes instead of just scanning
- Leaderboard IDOR fix — ownership checks now verify course membership before exposing student data
- Free-tier LLM fallback — when the free model hits rate limits, users seamlessly switch to an alternative free model
- Lesson content deduplication — content signatures prevent duplicate lessons from the same source material
- Lesson sharing with server-side indexing — shared lessons are properly tracked and shareable across users
- Lessons pagination — listing lessons now supports page/page_size parameters for better performance
🔧 Changed
- JWT removed from localStorage — authentication now relies exclusively on httpOnly cookies for improved XSS protection
- Lesson grounding logic improved — generation validates facts against source material more reliably
- Lesson ingestion refactored — batch context handling now processes multi-chapter documents more reliably
- Logged-in users redirected from landing page — creators go to courses, students go to learn page
- Settings page layout updated — cleaner visual hierarchy with improved responsive behavior
- Speaking exercise microphone handling — permission prompt appears before recording; better error messages for mic issues
- Lesson move and read logic hardened — improved edge case handling for concurrent access
- Malformed JSON handling improved — generation pipeline gracefully recovers from partial LLM responses
- Leaderboard query optimized — single query with window functions replaces multiple DB round-trips
- LLM concurrency capped — semaphore prevents thread-pool exhaustion under burst traffic
🐛 Fixed
- Debug runtime quota endpoint now functional in development mode
- Lesson export zip creation fixed — now handles mismatched data gracefully
- Team Board medals gated behind proper authorization — medals only shown when board has active students
- Leaderboard filters out students with zero lessons completed
- Matching exercise UX improved — incorrect selections auto-reset on new answer choice
- Progress ring removed from lesson node — users were misreading it as lesson progress
🔐 Security & Infrastructure Overhaul
✨ Added
- Lesson editor — creators can now edit any challenge (question, answers, explanation) directly in the browser before sharing
- Account deletion with full data cascade — removes lessons, progress, courses, shares, and quota records in the correct order
- Demo ingestion quota — unauthenticated users get 5 document uploads per hour with a clear signup prompt when limit is reached
- Backend integration test suite — 107 automated tests covering auth, courses, lessons, progress, rate limiting, and health checks
- Idempotent database migration runner — schema changes are tracked and safe to re-run on every deployment
- Health check endpoint now validates database connectivity and returns 503 if degraded
- Document ingestion duplicate detection — same content submitted twice within an hour is flagged, saving unnecessary LLM calls
🔧 Changed
- Custom LLM endpoints now validated against an approved provider list (Groq, OpenAI, OpenRouter, Anthropic) — prevents SSRF attacks
- Admin key comparison upgraded to constant-time to prevent timing-based enumeration
- Password reset tokens are now single-use — replaying an old link is rejected
- Password strength enforced at registration — weak passwords rejected with a clear message
- All error responses sanitized — internal details no longer leak to API consumers
- LLM calls are now fully async — no event-loop stalling under concurrent load
- Lesson save is now atomic — filesystem write and database index update happen together or not at all
- Database connections are now thread-safe with scoped sessions per request
- PostgreSQL connection upgraded to psycopg3 driver for better async and performance
- Input size caps applied across all endpoints to prevent oversized payloads
- Analytics tracking hardened; share ingestion throttles documented
- Mobile lesson and demo course UX refined
- Landing page cleaned up — removed unused sections and tightened CSS
🐛 Fixed
- Progress idempotency — browser retries no longer award double XP or double-increment streaks
- Auth enforcement tightened; several access-control gaps closed
- Course deletion now correctly cascades to associated lessons
- Lesson filename collision on same-second generation resolved with UUID suffix
- Dark mode popover rendering fixed; settings and leaderboard page flash on load eliminated
- GCS guard prevents startup failure when storage bucket is unreachable
- Static CDN references pinned to prevent supply-chain drift
🚀 Two-Week Update
✨ Added
- Lesson sharing flow with server-side invites and leaderboard filtering by shared students
- Creator controls on Team Board with member removal and confirmation modals
- Short-lived caching for stats, quota, and course data to speed up repeat visits
- SVG logo asset rollout across templates for sharper branding
🔧 Changed
- Role-based navigation, sidebar ordering, and redirects to reduce flicker and confusion
- Generator UI and prompts refreshed for corporate L&D workflows and clarity
- Settings quota view merged into a single combined card with cleaner hierarchy
- Learn page theming updated with new semantic tokens and gradient headers
- Moved Daily Streak and Total Stars from Settings into the learner's Team Board row
🐛 Fixed
- Share popover XSS hardening and safer modal confirmations
- SPEAK evaluation timeouts and lesson completion UX edge cases
- Artifacts static mount guard to prevent startup issues
- Lesson layout stability with scrollable content and non-shrinking footer
🎉 Initial Release
✨ Added
- AI-powered lesson generation from any text content
- Comprehensive gamification system with Stars, levels, and sparks
- Interactive quiz system with multiple question types
- Global Team Board with top learners ranking
- Quest system with daily, weekly, and milestone challenges
- Course management for teachers and administrators
- Progress tracking with detailed analytics
- Multi-subject support across languages, STEM, humanities, and skills
- Responsive design for all devices
🎨 Design
- Clean, modern interface with intuitive navigation
- Consistent spacing and typography across all pages
- Smooth animations and hover effects
- Progress bars with gradient styling
- Mobile-optimized layouts
⚠️ Temporarily Removed
- Adaptive learning loop (being redesigned for better performance)
Beta Testing Phase
✨ Added
- Beta user onboarding flow
- Feedback collection system
- Performance monitoring and analytics
🔧 Changed
- Improved AI lesson quality with better prompting
- Enhanced quiz question difficulty balancing
- Optimized loading times for lesson pages
🐛 Fixed
- Resolved spark counting issues on midnight rollover
- Fixed quiz answer submission edge cases
- Corrected Stars calculation for completed lessons
Internal Alpha Release
✨ Added
- Core lesson engine with quiz functionality
- Basic AI integration for content generation
- User authentication and account management
- Initial gamification features (Stars and levels)
- Prototype UI design
🔄 Adaptive Learning Loop
The end of December introduced an adaptive practice loop. Learners now move through mistakes, targeted review, and fresh drills so weak areas get extra attention. This feature was temporarily removed in February 2026 for redesign and performance optimization.
🤖 The AI-Native Rebuild
By late November, the app started its biggest transformation to date. AI became the core engine of practice and guidance, shaping everything from content generation to personalized feedback. This rebuild laid the foundation for intelligent lesson creation and adaptive learning experiences.
🚀 Public Deployment
By the end of February 2025, Prakly shipped on Google Cloud Storage with a production-ready foundation and early AI assistance available for select workflows. This marked the platform's first public release and the beginning of real-world testing.
🎤 Whisper Pronunciation Practice
In October, OpenAI Whisper integration started to bring pronunciation practice into the app and opened the door to deeper AI-powered learning workflows. This exploration laid the groundwork for future speaking features.
🌱 The Beginning
Prakly began as a personal learning tool, combining a Markdown editor with interactive exercises like typing, matching, and fill-in-the-blanks to support personal study sessions. This humble beginning sparked the vision for an AI-powered learning platform.