Changelog

New

• Platform API keys (ff_live_*) for programmatic access — generate from Dashboard Settings
• CLI remote commands — frameflow remote process, remote images, remote stitch, and more
• MCP server — AI agents (Claude, Cursor) can call FrameFlow as a native tool
• CLI OAuth login — frameflow login opens browser for authentication
• API key management — create, list, revoke keys from the Developer settings card
• Dual auth support — both API keys and JWT tokens work across all endpoints
• 10 remote commands: process, images, stitch, generate, status, download, exports, presets, whoami, health
• 9 MCP tools for full pipeline access from AI agents

New

• Ken Burns effects — create scroll experiences from static images with zoom-in, zoom-out, and pan effects
• Image sequence import — upload up to 50 images and turn them into a scroll experience
• Crossfade transitions between images in Ken Burns mode
• AI image-to-video — upload a reference image for AI generation (8 providers support it)
• Provider capability badges — see which AI providers support image-to-video vs text-only
• New "Images" input tab alongside Upload, URL, and Stitch
• Per-image effect and duration controls in Ken Burns mode
• Drag-to-reorder image sequences

New

• Import video from URL — paste any public MP4/MOV/WebM link instead of uploading a file
• Visual clip trim slider — drag handles over a thumbnail filmstrip to set start/end times
• Video stitching — combine 2–10 clips into one before processing, with drag-to-reorder
• Three-tab input switcher: Upload file, From URL, or Stitch clips
• Trim slider syncs bidirectionally with start/end time number inputs
• Full SSRF protection on URL imports (private IP blocking, DNS rebinding checks)
• Smart stitching: lossless concat when codecs match, re-encode when they differ

New Performance Fix

• Focus traps for all modals — Tab key stays within the dialog
• Full keyboard navigation for timeline editor (Tab, Arrow, Enter, Delete)
• Screen reader announcements for timeline marker selection
• Gzip/Brotli compression for all responses (~60-80% smaller transfers)
• Static asset caching with proper Cache-Control headers
• Playground limits fetched from server config instead of hardcoded

Security Fix

• Fixed XSS vulnerability in email templates — all user names escaped
• Fixed SSE memory leaks with proper pagehide cleanup
• Added maxlength to overlay/hotspot form inputs
• Removed hardcoded localhost fallback in password reset
• Toast notifications now accessible (role="alert", aria-live)
• SEO meta tags added to playground and reset pages
• Full mobile responsiveness for landing page

New Security

• Deployed to Railway at frameflow.sh with custom domain
• GitHub OAuth login with Google and GitHub providers
• Stripe billing integration with monthly and annual plans
• Resend transactional email (welcome, export ready, weekly digest)
• Auth gate — dashboard requires login in SaaS mode
• Helmet security headers, HSTS, CSP, permissions policy

Security Performance

• Zod validation on all user-facing API routes
• Admin rate limits on destructive operations
• Graceful shutdown with in-flight request draining
• Concurrency limiter with configurable queue depth
• Error sanitization — no stack traces in production responses
• Fetch timeouts on all external API calls

New

• Auto-caption: Upload video, transcribe audio, generate scroll-synced captions
• AI narration: Convert captions to spoken voiceover with voice selection
• Sound effects: Generate ambient audio from text prompts
• BYOK key management for ElevenLabs API keys

New

• Pika — text-to-video and image-to-video generation
• Stability AI — Stable Video Diffusion
• Google Veo — high-fidelity video generation
• Hailuo — fast video synthesis
• Genmo — creative video generation
• Total of 10 AI video providers now supported

New

• Public share pages with custom slugs and OG previews
• Community shared preset marketplace with search, tags, and forking
• Export analytics dashboard with scroll depth, hotspot clicks, quiz responses
• Frame-level dropoff heatmap visualization
• A/B testing framework for exports
• Template gallery with featured templates and filtering

New

• Text overlays with position, timing, and font size controls
• Interactive hotspots with tooltips and links
• Snap points for scroll pausing
• Crossfade, blur, and zoom transitions
• Parallax layers with speed and opacity controls
• Caption system with SRT import
• Quiz overlays with branching logic
• Visual timeline editor with drag-and-drop markers

New

• React, Vue, Next.js, Astro, Svelte component export
• Batch processing for up to 20 videos
• WebP and AVIF frame format support
• Responsive export option with srcset
• Custom scroll direction (horizontal, reverse)
• Scrub preview with frame thumbnails

New

• Upload video, extract frames, export scroll-controlled HTML
• Configurable FPS, resolution, scroll length, theme
• JPG frame format with quality control
• GIF export option
• Real-time progress via Server-Sent Events
• ZIP download with self-contained HTML viewer
• Preset system for saving/loading configurations
• Playground mode for instant no-signup trial
• Stripe billing with 4 tiers (Free, Starter, Pro, Enterprise)
• Supabase auth + encrypted API key storage