New
Pre-built Claude skills are here. Set up Claude and Kolvera end to end — then run your whole workflow just by chatting.
Get the skills →
All Updates
TL;DR
This week we shipped a comprehensive security hardening pass, major database performance improvements, a unified contact model merging Contacts/Prospects/Candidates into one record, campaign enrollment deduplication across all paths, warmup reliability fixes, JobAdder ATS integration, table streamlining across Pipeline/Contacts/Prospects, server-side ICP filtering with pagination, a broadened CSV importer, and a new target role field on contacts.
Security Hardening
- XSS vulnerabilities fixed — Identified and patched cross-site scripting vectors.
- Webhook signature enforcement — All inbound webhooks now reject unsigned requests.
- OAuth security — OAuth flows now include cryptographic protections against CSRF attacks.
- SSRF protection — Server-side request forgery protection blocks requests to internal IP ranges.
- Deprecated flows removed — Legacy authentication flows that didn’t meet current standards have been removed.
- Content Security Policy — Full CSP nonce enforcement across the application.
Database & Performance
- Database performance — Comprehensive indexing pass across all major tables. Queries on large datasets are materially faster.
- Faster search — Partial-match search across contacts, emails, and companies is dramatically faster at scale.
- Scalable architecture — Background processing can now scale per-tenant, preventing one busy account from affecting others.
- Structured logging — Improved log output for faster debugging and monitoring.
- Container hardening — Tightened container security and improved memory management.
Unified Contact Model
- One person, one record — Contacts, Prospects, and Candidates are now the same underlying record. No more duplicate data across different views.
- Multi-role support — A single contact can be both a prospect (linked to an Ideal Client Profile) and a candidate (linked to a Reverse Market Profile) simultaneously.
- Shared history — Email logs, call transcripts, campaign enrolments, meetings, and notes are all on one record regardless of which view you access them from.
- Seamless promotion — Click “Add to Prospects” or “Add to Candidates” on any contact to flag them for that pipeline. No data migration needed.
Campaign & Warmup Reliability
- Warmup duplicate send fix — Resolved an issue that could cause warmup emails to be sent more than once.
- Safe enrollment — All enrollment paths now use unified deduplication and blocklist/DNC checking. No duplicate enrollments regardless of entry point.
- Variant lockdown — A/B/C variant configuration is locked after campaign activation to protect data integrity. Pause/resume per-variant still works.
- Enrollment deduplication — Database-level safeguards prevent duplicate enrollments, catching edge cases automatically.
- Campaign rate accuracy — Open, click, and reply rates now use sent count as denominator (not enrolled). Variant cards show a Sent column for clearer comparison.
Table UX Overhaul
- Pipeline columns 12 → 7 — Removed Priority, Status, Posted, and Link columns. Key data visible at a glance with filters available for deep dives.
- Contacts columns 11 → 7 — Removed Source, Ad Role, and Added columns. Email status shown as a coloured dot with hover legend.
- Prospects columns 13 → 9 — Same streamlining pattern. Bulk actions switched to pill-style progress indicators.
- Column picker on Candidates — Show/hide columns with a toggle menu. Hidden-by-default columns reduce visual clutter while remaining accessible.
- Edit contact company — Company field on the edit contact modal now uses autocomplete with your existing company list.
- Email status dot legend — Colour-coded dots (green/amber/red/grey) on the credit costs bar explain what each email verification status means.
ICP & CSV Improvements
- Server-side ICP filtering — ICP prospects now filter and paginate server-side. Handles thousands of prospects without browser slowdown.
- Date range filters — From/to date inputs with quick-select buttons (Today, 7d, 30d, 90d) on ICP prospects and Prospects pages. URL-persisted so filters survive navigation.
- CSV importer broadened — Column mapping now recognises a wide range of header formats. Import files from any CRM or job board export.
- Target role field — New field on contacts for tracking the vacancy being recruited for. Shown on prospects page, ICP prospects, and prospect detail. Accepted in CSV import.
- Bulk action auto-refresh — Pages reload automatically 2 seconds after any bulk action completes, showing updated data without manual refresh.
Scrape Reliability
- Resilient scraping — Scrape jobs now survive deployments and have automatic timeout protection.
- Stale job cleanup — Jobs that run longer than expected are automatically cleaned up.
- AJAX submission — Starting a scrape no longer requires a page reload. Submit and watch progress update in real time.
- Per-company timeout — Find Contacts operations have per-company timeouts, preventing a single slow lookup from blocking the batch.
Integrations & ATS
- JobAdder ATS integration — Full integration: OAuth connection, contact sync, job sync, candidate push, and activity logging. Connect from the Integrations page.
- SSL certificate fix — Resolved intermittent SSL handshake failures on outbound email delivery that were causing campaign sends to retry unnecessarily.
- Team invite OAuth fix — Fixed a bug where accepting a team invitation via OAuth would fail to link the new user to the inviting tenant.
Quality & Testing
- Comprehensive test suite — Full test coverage across all routes, models, and background tasks. Every deployment is verified automatically.
- Full-app smoke test — Every page in the app automatically tested for errors after each update.
- Progress pill fixes — Fixed dismiss comparison (started_at), failed pills now persist correctly, bell notifications fire on completion, and pills no longer ghost-reappear after dismissal.
- Action logging — Bulk actions now log per-item results (name, status, email/phone found) for the Logs page.
- Meeting reminders — Automatic email reminders 24 hours and 1 hour before scheduled meetings to both contact and host. Bell notification with amber clock icon.