Product updates

Changelog

Track customer-facing product improvements, security outcomes, and compliance reporting updates across VAT Engine.

Archive page 16 of 23.

Latest release: 3.6.383; Cross-platform Decision Replay Is Clearer
Releases tracked: 270; Since January 2026
Logged changes: 785; Across customer-facing categories

SecurityFeatureImprovementFix

Showing releases 181-192 of 270

3.6.140July 15, 2026

Shopify Public-App Access Has An Explicit Free Boundary

6 changes

Feature4 items

VAT Engine now declares its current public Shopify app posture as free, with the included plan visible in both Shopify App Home and VAT Engine operator diagnostics
Installing, reconnecting, syncing, repairing webhooks, and using Shopify App Home do not require a Stripe checkout or another external subscription
Missing or partial public-app billing data now renders as an unavailable configuration warning instead of being treated as a confirmed free entitlement
The free-app badge now requires both an included plan and a confirmed absence of external billing, so mixed states stay non-positive

Security2 items

Unsupported paid billing modes are rejected until VAT Engine implements Shopify App Pricing as the single entitlement owner, preventing an accidental external billing gate or double-charge path
Shopify App Home fails closed with an actionable plan-status message if it reaches an older API during a rolling deployment

3.6.139July 14, 2026

Admin Sign-Out Moves To The Global Header

3 changes

Improvement3 items

The admin sign-out control now appears at the right edge of the global application header instead of the collapsible left sidebar or secondary admin toolbar
The global-header placement remains available across the admin overview, security, and TEDB synchronization pages
The admin sign-in screen now uses the same branded global header without displaying a sign-out action before authentication

3.6.137July 13, 2026

Shopify Account Linking Requires Confirmation

2 changes

Security2 items

Opening a Shopify OAuth account-link URL no longer links a store automatically, including after VAT Engine sign-in or two-factor authentication
The signed-in account holder must explicitly confirm the selected Shopify store before VAT Engine consumes the one-time authorization and creates the connection

3.6.134July 12, 2026

Shopify Linking Now Reopens App Home Safely

2 changes

Fix2 items

After a Shopify store is linked or reconnected, VAT Engine now returns through Shopify Admin so the app opens with a fresh embedded session
The account-link flow no longer lands on an invalid embedded-context screen after successful authorization

3.6.133July 11, 2026

Shopify Import Job History Loads On Demand

2 changes

Improvement2 items

Shopify integration activity now shows the latest import jobs first and lets account owners load older history without leaving the operational view
Long-running stores stay responsive because earlier job history loads in small pages instead of opening an unbounded activity list

3.6.132July 11, 2026

Shopify App Home Now Uses Store-Specific Iframe Protection

2 changes

Security2 items

VAT Engine now permits Shopify App Home to be framed only by Shopify Admin and the verified permanent .myshopify.com domain for the current store
Invalid, missing, spoofed, or conflicting Shopify App Home context is rejected instead of broadening frame access. Dashboard, public, account-link, and API routes retain their restrictive framing behavior

3.6.131July 11, 2026

Shopify App Home Now Links New Stores Securely

4 changes

Security2 items

A new Shopify App Home install now derives the store only from Shopify’s verified embedded session. VAT Engine does not ask merchants to type a shop domain or send Shopify authorization tokens through the browser
VAT Engine holds an approved but not-yet-linked Shopify authorization only as short-lived encrypted state while the merchant signs in or creates the VAT Engine account that will own the connection. The account-link step consumes that state once, so concurrent sessions cannot reuse one link

Feature2 items

New Shopify App Home launches immediately begin Shopify authorization, then provide a focused account-link step before returning merchants to the embedded VAT Engine module
Disconnected stores use the same Shopify-owned reauthorization path, while duplicate or ambiguous account links stop safely instead of guessing a workspace

3.6.129July 10, 2026

Shopify Setup Docs Now Match The Live Install Flow

3 changes

Improvement3 items

The public Shopify setup guide now describes the live guided dashboard connection flow that supported VAT Engine deployments already use today, instead of treating that flow as future-only
The Shopify setup docs and app-configuration panel now explain that embedded Shopify Admin access after install and public App Store availability are separate questions, so merchants can tell the difference between current setup behavior and wider app distribution timing
This was a customer-facing guidance update only: no stored credentials, sync behavior, or VAT filing logic changed in this release

3.6.125July 9, 2026

Shopify App Home Now Exposes A Secure Embedded Admin Module

2 changes

Feature2 items

Shopify merchants can now view store connection state, source linkage, granted permissions, sync health, webhook status, and historical-access blockers directly in Shopify Admin
Reconnect, disconnect, import, reconciliation, and webhook-repair controls are available for the current Shopify store without exposing saved access details

3.6.124July 9, 2026

Shopify Privacy Webhook Acknowledgments Now Stay Opaque

1 change

Security1 item

That removes the response-body installation-state oracle for valid signed privacy webhook callers while preserving the internal no-op path, server-side logging, and strict fail-closed validation for invalid signatures, topics, and payloads

3.6.120July 9, 2026

Unknown-Shop Shopify Privacy Webhooks Now Confirm Receipt Safely

1 change

Security1 item

Verified Shopify privacy callbacks that do not resolve to any current or historical VAT Engine storefront now return a deliberate 200 no-op instead of leaking a 404 installation-state signal back to Shopify

3.6.119July 9, 2026

Shopify Zero-VAT Tax Signals No Longer Override Product Review Gates

1 change

Security1 item

Shopify tax-treatment diagnostics still show order-level tax exemption and explicit zero-rate tax-line evidence, but those signals no longer bypass unresolved VAT Engine product-tax review states