Inkwave

A platform where every publisher brings a domain can be tricked into issuing certificates for domains nobody connected, or into serving one publisher's site under another's name.

Every publisher on their own domain

Before a certificate is issued, the edge asks the platform whether the domain belongs to a publication; the check fails closed and compares its shared secret in constant time. The site renderer maps each hostname to its publication and strips any identity header a visitor could forge.

Two editors, or an editor and an AI assistant, saving the same page at once silently overwrite each other, and a half-finished draft leaks onto the live site.

A website builder that cannot lose work

Every page's block tree carries a revision number, and a save made against an old revision is refused instead of merged blind. Live sites serve the published snapshot, never the draft, and an unpublished site answers 404. One shared block-schema package validates and repairs every block in the editor, the renderer and the API alike.

A send that dies halfway through a list and retries from the start emails thousands of readers twice.

Newsletters that go out exactly once

Each broadcast runs as a durable workflow on Restate, sent in batches of 100 recipients. Every batch is recorded as done exactly once, so a retry picks up where it stopped and never re-sends. Delivery webhooks are signature-checked, and a postal address is required before anything is sent.

Open and click counts are inflated by mail-privacy proxies and bots, and per-reader tracking cookies are a consent problem in every market.

Analytics without cookies

Events are batched into ClickHouse, flushed at 50 events or every three seconds, and visitors are counted with a hash salted per day, so no cookie is set and nobody can be followed from one day to the next. Apple Mail privacy and bot opens are separated from real ones, and activity data expires after 18 months by table rule, not by a job someone has to remember.

In a multi-tenant product, one missing check lets a publisher read or change another publisher's audience.

Every write inside its own publication

Sign-in moved from Firebase to Clerk, with tokens verified locally. Writes are scoped to the caller's publication in a shared service layer, and live-collaboration sockets re-check editing rights against the database on every connect. The AI-assistant (MCP) server never takes a publication from the request: the credential decides it, with consent and a budget on every write.

Money moving between readers, publishers and the platform is where a missing webhook becomes a missing payment nobody notices.

Paid subscriptions that reconcile

Publishers sell paid subscriptions through Stripe Connect while the platform bills publishers, and every Stripe webhook is signature-checked. Failed payments are stored, not logged and dropped, and refunds and subscription history are written from webhooks, so both sides keep an invoice trail.