Release notes

Teams can connect Stripe, and parents are actually told.

• Invitations to parents were being sent to an address that does not exist, so no parent was ever actually told their child appears on a fundraising page. A real email address is now required for every player, and the invitation goes to it.
• Coaches can connect their team's own Stripe account from the dashboard. It says plainly what Stripe still needs, rather than leaving you guessing.
• A fundraiser can no longer be shared before its team is able to receive money — it opens on its own once Stripe says the team is ready.
• The fee is one number in one place: 5% to Back The Side. Card processing is charged to the team by Stripe, so on a $50 gift the team keeps $45.75.
• Donor checkout reads in Spanish, and says what a refund would return before a card is entered.
• Every fundraiser page has a quiet link to report it. A report is read by a person and never takes a page down by itself.
• Card payments are still not live. Nothing here charges a real card yet, and this stays below 1.0 until a real payout has been seen.

This page.

• Published release notes, so a change to how photos or money are handled is something you can read rather than something you have to notice.
• The site now shows its version in the footer, which is the quickest way to tell whether a fix has actually reached you.

Security updates, and the deployed site caught up with five days of fixes.

• Updated Next.js and the image library behind photo uploads, closing two critical vulnerabilities published by Vercel on 25 August.
• Hardened what the photo upload accepts, so an image format known to crash the decoder is refused before it is ever read.
• Brought the production database in line with the code. Two finished features — the tax verification queue and the payment-readiness gate — had been reading columns the live database did not yet have.
• Fixed the deployment problem that had been silently rejecting every update since 26 August.

A hostile pass over the running site, and two real fixes.

• Fixed a missing protection on QR code images, which could have leaked the page a code was scanned from.
• Added framing protection to the sign-in and organiser pages, so no other site can invisibly overlay them.
• Confirmed the database's row-level security is closed on every table, with no policy granting public read.

The product became Back The Side, and email became real.

• Renamed from The Huddle to Back The Side, on backtheside.com. The sender, the sign-off and the domain now agree, which is what keeps mail about a child out of a spam folder.
• Receipts and invitations are sent for real, and a bounce is noticed rather than assumed delivered.
• Sharing by text hands off to the phone's own messaging app, so no number is ever typed into this site.
• Donations are refused unless the organisation can actually be paid, rather than failing at the last step.

First public build.

• A coach can start a fundraiser, invite parents, and follow the total.
• Every player gets a private page that search engines are told to ignore, with a link the parent can revoke at any time.
• A parent chooses what appears, from a first name down to nothing at all, and a mascot instead of a photo.
• Photos are re-encoded on upload, so the location tags a phone camera writes never reach the site.
• Donors can give without an account, choose how they are named on the wall, and get a receipt.
• A team-only fundraiser is available for teams that would rather not list children at all.