Changelog
What shipped, when. Morvero is portfolio-level product intelligence for enterprise software — this page tracks the visible changes.
2026-08-15 — Reports that say what to cut, fix, and fund
- Every product now carries an evidence verdict, and the portfolio chart respects it. A product with the snippet in the footer and nothing else tagged used to sit in the quadrant looking like a low-engagement product. It wasn't — it was an unmeasured one, and nothing on screen said so. A new coverage report scores each product on whether it is actually measured: when it last sent data, how many functions are tagged, how much feedback per 1,000 views. Products below the evidence floor are drawn in a labelled band outside the quadrant instead of landing in "Retire?", the executive report names them so the summary sentences aren't silently about them, and the floors are printed rather than implied. This is the change that makes the rest of the numbers worth reading.
- "Which of my pages and functions is dead?" is now a question the product answers. Rankings are ordered by uses per 100 visitors of that product, because a raw count mostly ranks how busy the surrounding product is. Deactivated products no longer pollute the tables. Items with too little volume to compare are counted and reported rather than silently dropped, and items first seen inside the period are left out instead of being ranked as dying. The old "least used" table — which mixed products and could repeat rows from the most-used table — is replaced by the bottom of each product's own list, addressed to the team that can act on it. Per-page feedback counts sit alongside, so a one-star page with a single rating no longer reads as the worst page in the app.
- URLs with IDs in them stop shredding the page report.
/invoice/8842 and /invoice/9931 now group as one row, /invoice/:id, with the number of distinct paths shown. Numeric ids, UUIDs, hashes and opaque tokens are recognised automatically — no configuration, no rules to maintain, and it applies to data you already collected. The raw path is never modified, so funnels and data-subject exports are unchanged.
- What stopped, not just what's happening. A "Needs a decision" block leads the Overview and the board report: products that went silent, products below the evidence floor, a live snippet still reporting on a product the workspace thinks was retired. One level down, per product, pages and functions that used to fire and no longer do — with the lookback window and the retention cap stated, because "no data" and "zero usage" are not the same finding. (Growth and up.)
- Prompt response rate — finally a number instead of a guess. The widget now reports when a proactive prompt was actually shown and when it was closed unanswered, so you can see shown / answered / dismissed and set sampling from evidence. Someone who navigates away with the panel open is counted as neither: the report shows an explicit ignored bucket rather than implying that responses and dismissals account for every prompt. (Growth and up.)
- Sentiment and adoption at the function level. Feedback now records the last tracked function used before it was submitted, giving sentiment per function for the feedback where that's known — labelled as exactly that, never as "the function they rated", and always shown next to the page-level cut and the coverage figure so you can see how much of the feedback it speaks for. Alongside it, adoption curves for a newly shipped function: when it first fired and what share of visitors have reached it since. (Growth and up.)
- Decisions shipped from user evidence. A closed-loop report answers the question that decides renewals: what did we actually do about any of this? Decisions taken and accepted, how many pieces of feedback each accepted item cites, what was exported to Jira or Azure DevOps, what's still open — per product and per tribe, with the recent accepted items listed as citations you can put in front of a steering committee.
- The tribe altitude reaches the board report. Tribes were a card on the Overview and nothing else; the executive report went portfolio → product with the org chart missing from the middle, which is exactly the level where accountability conversations happen. Tribes now get their own section with period-over-period movement and a measured-of-total count, plus a tribe column on the product scorecard. Where there is no comparable prior period, it says so instead of printing a delta. (Growth and up.)
- Getting the tables out. CSV export covers the page table, the function table and the portfolio scorecard, not just feedback (Growth and up; writer roles only). The read API gains the coverage report and the page and function tables as first-class endpoints — served as a slice of the same query the console uses, so a warehouse and a dashboard cannot disagree about the same number. On Scale, Morvero can also list the functions your pages declare and compare them with what has actually fired, which separates "tagged at launch, never used since" from "never tagged at all" — with the honest caveat that it reads your HTML, so functions tracked from JavaScript are invisible to it and an absent name proves nothing.
- Throughout: visitor figures stay labelled per device, counts held back for being too thin are reported as held back rather than shown as zero, and none of this introduces per-visitor profiling or segmentation.
2026-08-14 — The Trust Center, and a security hardening pass
- Trust Center at /trust: every control we run, written control by control with a pointer to the part of the system that implements it — and a plainly-stated what we do not have yet, because a vendor who claims everything is the one worth worrying about. The old
/security page now redirects here, and the landing page carries a Trust & security summary.
- The widget is pinned by Subresource Integrity: the install snippet is version-pinned, the versioned URL is immutable, and an unknown version 404s rather than serving different bytes. Your pages therefore cannot silently begin executing different code — including if our own origin were compromised. Current version, hash and path are machine-readable at
GET /api/widget-asset so you can automate your pin and your CSP, and widget size is now held to a gzipped budget enforced as a build failure.
- PII is redacted before it is written: email addresses, phone numbers, national IDs, IBANs and card numbers are stripped from feedback comments and captured form values at collection time, so exports, webhooks, AI summarisation and the console only ever see the redacted text. Numbers carrying a checksum are validated rather than pattern-matched, so a real national ID is removed while an order number of the same length survives.
- Collection you can govern across a portfolio: a privacy operator can lock screenshot and form-entry capture off for the entire workspace. Product owners and AI agents acting over MCP are both refused, the lock is evaluated at collection time so already-cached widgets are dropped rather than stored, and unlocking restores each owner's original choice instead of silently switching collection back on.
- SSO enforcement and access review: SAML SSO can now be enforced, closing the email-link and passkey doors so deprovisioning someone in your IdP actually revokes their access here — and it cannot be switched on without a designated break-glass owner. A new access review export names every person, every product they can reach, and the specific grant behind it (direct assignment, squad, product owner or tribe lead), plus any active support window.
- Hardening: session tokens, OAuth tokens and read API keys are stored as SHA-256 hashes; integration credentials are sealed with AES-256-GCM under a key held only in the runtime environment; the CSP dropped
unsafe-inline; the SSRF egress guard now resists DNS rebinding; SAML assertions are single-use; and share-link revocation is restricted to the roles that should hold it.
- A product's domain allowlist is now editable from the product page, not only at creation.
/healthz alongside /api/health for uptime monitors, and the top nav folds into a menu when the links stop fitting — measured rather than guessed, so it stays correct in all five languages.
2026-08-12 — A launcher that gets out of the way
- Visitors can drag the feedback launcher anywhere on the page. Bottom-right is crowded on real products — sticky CTAs, chat bubbles and cookie bars all live there. The spot is remembered per browser as a side plus a vertical fraction, so it survives a resize, a rotate, or a different-sized screen. Arrow keys move the focused launcher too: a mouse-only escape hatch is no escape hatch for keyboard users.
- Two more shapes and eight icons: alongside the circle, a labelled pill and a tab riding the middle of a screen edge, which structurally avoids the crowded corner. The attention nudge is its own toggle rather than part of the shape, it stops for good once a visitor opens or moves the launcher, and it never runs under
prefers-reduced-motion.
- Defaults are unchanged — existing installs look exactly as they did.
2026-08-06 — Attachment capture became a setting
- Screenshot attachment and form-entry capture are now per-product toggles (default on), on the product page's Setup tab and over MCP via a new
update_widget_settings tool. While a toggle is off the widget hides the checkbox and the collect API drops that attachment — so a widget still running cached config cannot keep sending it.
2026-08-03 — Campaign attribution
- Judge the link, not the launch: tag a published link with
?src= or standard utm_campaign and utm_content, and the tag rides the whole visit rather than just the landing hit — every pageview and every tracked action is attributed to the campaign that brought the visitor, so two placements of the same campaign stay separable. Surfaced as a Traffic sources card on the product page and in the MCP get_product_analytics output. The query string itself is never collected, and utm_source/utm_medium stay deliberately uncollected.
2026-08-01 — The product page, rebuilt
- A KPI header plus five tabs — Usage, Audience, Feedback, Backlog, Setup — replacing roughly fifteen stacked cards that repeated pages, functions and visitor counts in three places each. Always-visible KPI tiles, the agent scorecard for pilots, and a per-product range selector synced with the Overview.
- Mobile: the sidebar folds into a top bar on narrow screens, tables scroll inside their own cards, and charts get fixed-height boxes — fixing page-level horizontal scroll on phones.
2026-07-31 — Billing went live
- Lemon Squeezy checkout hardened before the account went live: webhook handling corrected, and the package mapping is re-read before a sale is ever refused over it.
- Affiliate referral tracking on our own marketing pages at morvero.com, disclosed in the Privacy Policy. It runs only there — never in the widget, the console, or any self-hosted install.
2026-07-30 — Bot traffic dropped at collection
- Visitor counts now mean people. Crawlers, headless browsers and link unfurlers execute the widget but never persist local storage, so every visit minted a brand-new visitor id and inflated the numbers. Known bot user agents are now dropped at all four collect endpoints. Signature-based on purpose rather than "anything that isn't a browser" — agent pilots and native apps legitimately report from their own backends, so
agent-kind products skip user-agent filtering entirely. A missed bot costs one stray pageview; a false positive would erase a real user's usage.
2026-07-21 — The blog and the playbook library
2026-07-21 — The agent-readable layer, Scale tier
- Agent-readable everything: llms.txt, full docs as Markdown at /docs.md (and
/llms-full.txt), an OpenAPI spec for the collection and read APIs, robots.txt and sitemap, and structured metadata across the site.
- AGENTS.md for your repo: the MCP
get_install_snippet tool (and a new "Copy AGENTS.md" button on console product cards) now emits a block for your repository's AGENTS.md / CLAUDE.md so every future coding-agent session knows how Morvero is instrumented there.
- Honest comparisons: Morvero vs Pendo, Morvero vs Microsoft Clarity, and a practical guide: How to measure AI agent pilots.
- Scale tier ($499/mo flat): 50 products, SAML SSO, NPS microsurveys, read API for BI, cohorts, and the AI-pilot steering-committee report — self-serve, no sales call.
- Fixed country resolution for traffic behind multi-hop proxies.
2026-07-20 — Billing, geography, and the roadmap sprint
- Self-serve billing via Lemon Squeezy: upgrade in-app, card on file, invoices handled.
- Country tracking: a world heat map on the Overview and per-country usage per product — resolved server-side from the request IP, which is discarded immediately (only the two-letter code is stored).
- Drop-in native SDKs: single-file Swift and Kotlin wrappers — no package manager needed.
- Privacy-preserving cohorts: optional coarse group labels (department, region) with a k-anonymity floor — cohorts under 5 visitors are withheld entirely.
verify_install: the MCP tool that closes the loop — after instrumenting, an agent can confirm data is actually arriving (working / silent / never-received, with the likely blocker named).- AI-pilot steering-committee report: every pilot side by side — task success, escalation rate, cost per conversation, cost per completed task.
- Funnels: 2–5 step page-path funnels computed over already-collected pageviews — define one today, it answers for the last 30 days.
- Security trust page (/security) with a control-by-control writeup, plus RFC 9116
security.txt.
- Executive email digest & anomaly alerts: weekly/monthly summaries and three continuously-running detectors (usage drops, rating drops, feedback spikes) that email the accountable owners.
- Connected MCP apps are now visible and revocable per user in Settings.
2026-07-19 — Morvero, and the MCP connector
- Rebrand: Pulse became Morvero — new mark, palette, and typography.
- MCP server: AI coding agents connect via OAuth 2.1 at
https://morvero.com/mcp and can create products, fetch real install snippets, read feedback and accepted backlog items, and query analytics — scoped to the signed-in user's role.
- AI-agent pilot tracking: products of kind "agent" with server-side telemetry conventions and relabeled dashboards.
- Usage-monitoring-only mode: per-product switch that hides all feedback UI and collects usage numbers only.
2026-07-18 — Initial release
- The platform: one-line widget install, anonymous usage analytics (pages, functions, SPA-aware), in-product feedback with screenshots and scrubbed form context, triage with statuses/assignees/tags, AI theme summaries and backlog suggestions with acceptance criteria, Jira & Azure DevOps export, portfolio quadrant and board report, passwordless auth with passkeys, GDPR/KVKK tooling.
Dates are ship dates on morvero.com. For the full product story, start at the How-to Guide.
morvero