What's new.

Deliveries carry webhook-id, webhook-timestamp and webhook-signature, signed over {id}.{timestamp}.{body} and base64-encoded — the same scheme Svix and Stripe use, so most verification libraries work as-is. Reject anything more than five minutes from your clock to stop replays. ACTION NEEDED if you had an endpoint before this release: the old X-Signature-256 / X-Rebaar-Signature headers are gone. The API docs carry a copy-pasteable verifier.

invoice.created, project.created, project.status_changed, lead.created, quotation.approved and quotation.rejected were offered but never sent. They now send, alongside invoice.paid, invoice.overdue and lead.won.

Settings → Webhooks now shows every delivery: the payload we sent, your response, the HTTP status and the attempt count. A failed delivery says whether it is still retrying (2/5) or has given up — and gives you a Replay button for the ones that have.

Plan every project on one timeline: drag to move, resize and link tasks (FS/SS/FF with lag), and the critical path recomputes as you work. Working calendars (Mon–Sat + holidays), baselines with slip-vs-plan, milestones, monsoon buffers, and the payment-gate padlock right on the bar. On Growth and Scale; Starter keeps the phase list.

Bring an existing plan in from a sheet — phases, tasks, dates, owners and predecessors (3FS+2 style), checked row by row with a preview before anything is written. Export the live schedule back to Excel or CSV, or print it to PDF.

Ctrl-Z / Ctrl-Y for any drag or link (refused, never forced, if a colleague changed the row); arrow-key nudge; drag rows to reorder; search, filter and sort with a shareable URL; fullscreen and compact density.

Assign a task to a person and it appears in their My Work with a progress slider and status — they report the work without being able to move the plan. New-assignment notifications included.

Ten adversarial review passes across the release (full authorization checklist + bug hunts): workspace isolation and version-guarded writes verified on every schedule route; dozens of edge cases fixed before they reached you.

The project Accounts tab now projects the FINAL cost from spend-so-far at the current progress — with an early warning when a project is under budget today but heading over at its current burn rate.

New Accounts → Revenue forecast report: the next 3 months of expected money-in from invoices due (by month), recurring invoices (GST-inclusive), and the quote pipeline — shown unweighted, never mixed into the month totals.

Site records → Inspection now carries a proper checklist: pick a template (pre-pour, brickwork, waterproofing starters included), mark each item Pass / Fail / N-A, and the outcome derives itself. Save any ad-hoc list as a reusable template.

Log repairs, preventive services and inspections against each machine with cost, vendor and due date. Completing a preventive service rolls the next-service date forward automatically when a service interval is set — and the existing service-due alerts pick it up.

Adversarial review of the entire release: tenant isolation and authorization verified clean; fixed an empty-update crash, an over-strict checklist limit that could reject long inspections, stale-schedule inflation in the forecast, and a handful of edge cases before they reached you.

The complete NIC e-Way Bill lifecycle, tested end-to-end against the live GSP sandbox: generate (from an invoice or standalone, multi-item), update vehicle (Part-B), update transporter, extend validity, cancel, close, reject, consolidated trip sheets and multi-vehicle movement. A new Reconcile screen pulls e-Way Bills straight from NIC for any date — including bills raised on you by others, which you can reject within 72 hours.

A "Verify" button on the recipient GSTIN auto-fills their registered name, PIN and state — and warns if the GSTIN is inactive or e-Way-blocked. Type an HSN code and its official description appears, so a wrong code never reaches NIC.

Once an invoice has an IRN, generate its e-Way Bill in a single step — the party and goods come from the e-invoice, you just add transport. Refresh live IRN + e-Way status from NIC, and print a scannable B2C dynamic QR on non-IRN invoices.

Every NIC rejection now reads as an action ("HSN must be at least 6 digits", "document date is more than 180 days old", "you've hit the rate limit") instead of a raw numeric code — and the app catches most mistakes before you submit.

Errors now appear right below the field that caused them across the whole app — not just as a toast — so you fix the exact input, faster. Error toasts are red, success is green, no more colour mix-ups.

A full end-to-end review mapped to the OWASP Top 10 — multi-tenant isolation, authorization, injection/SSRF, secrets and payments all swept. Tightened finance-visibility on a few amount-bearing read endpoints, added defense-in-depth workspace scoping, and hardened webhook idempotency to the canonical event id.

Length fields now have a per-field unit picker: m, cm, mm, ft, in, or "ft + in" entered as two boxes the way drawings read. 17 calculators rewired (excavation, PCC, RCC, BBS, shuttering, concrete, brickwork, plaster, staircase, round column, compound wall, concrete pipe, roof pitch, asphalt, top soil, anti-termite, tank, wardrobe). Maths still runs in metres internally — your saved BOQs are unaffected.

On PCC, RCC, concrete, shuttering and excavation, hit "Add this to schedule" to stack F1, F2, F3 calculations under the live inputs. Tick which rows to include, then "Add N rows to project →" sends them straight to a project's BOQ as separate line items.

New 📚 picker modal opens inside quotations (new + edit), project BOQ tab, and the estimator. Search by code/description, filter by category, "+ New rate" inside the picker creates AND picks in one click. BOQ rows from the library are linked back via rateItemId.

Adds a 5th type for small / special jobs — retaining walls, compound walls, sheds, landscaping. Free-form description field is saved into the quotation notes when you export.

7th status "Work from home" (W) sits next to Present (P). Both count as a paid worked day; reports split office vs remote so you can answer "how many days did X come to site" vs "how many did they work".

New /attendance/insights — present-today snapshot, 30-day company attendance %, WFH share, employee × day heatmap (sortable by attendance %), per-employee summary table.

Clicking a manual-entry grid cell now opens a small dropdown with all 7 statuses instead of cycle-tapping through them. Faster on mobile, harder to mis-mark.

Profile attendance tab now reads both biometric punches AND manual entries, with a colored calendar, source pills (Biometric / Manual / Both), and a status breakdown bar.

Rate limits on /api/client-approvals/signoff and /api/account/export; 90-day TTL added to client signoff tokens (migration 0053); OCR storage-path traversal guard; tightened QuickBooks query escaping; webhook retry backoff math fix; OIDC userinfo fallback now requires email_verified.

Several pages (rate library new-rate, sample library, materials, labor, invoices, equipment, drawings, BOQ templates, mood boards) had transparent modal surfaces because the `--bg` CSS token was referenced but never defined. Added the token to both light & dark themes — fixes every affected modal at once.

Connect your own Razorpay merchant in Settings → Integrations. Customer payments on invoices now settle directly into your bank account, not ours. Webhook verification uses your per-workspace signing secret. Same model Shopify and Zoho CRM use.

Per-workspace IRP (e-Invoice) and e-Way Bill credentials. Every invoice registers IRN under YOUR GSTIN at NIC, every EBN is issued in your firm's name. Encrypted at rest.

Connect your own Meta WABA so reminders and updates go from your verified business name and phone number. Step-by-step setup walkthrough inside Settings.

Share your code with another builder. When they convert to paid, you get ₹500 credit auto-applied to your next Rebaar bill. One-click WhatsApp share.

Outgoing emails now show "Your Company via Rebaar" with your reply-to address. Clients reply to YOU, not us.

Constant-time comparisons on OAuth state, SAML RelayState, IP-binding hashes; alg=none JWT defence; race-safe referral ledger with partial UNIQUE index; permission gates on 13 money-path mutation routes.

Operator infrastructure (Sentry, S3, Anthropic, Web Push, Resend provider) hidden from the customer Integrations view. Only the integrations you control are shown.

Bar bending, concrete, modular kitchen, false ceiling, AC tonnage and 11 more.

Mood board, 3D renders, samples, procurement, installation, snagging — replaces construction tabs for type=Interior.

Track laminates, paint chips, fabrics, stone — across all projects.

We now compute the HSN-wise breakdown and push it to your filing draft.

Bulk-match webhooks against open invoices in one pass.

Dashboard now under 800ms on 4G.

Auto-send the day's photos + progress % to client at 7 PM. Opt-in per project.

Owner / PM / Site Engineer / Accountant / Partner / Employee each get a tailored landing.

Vouchers now sync with cost-center and project tags.

Cleaner header, fewer pages, IRN auto-fetched.