We write these because a platform that only publishes good news is a platform you should read carefully. Here is a fortnight, including the part that did not go well.
Two-factor authentication, and where we put it in the wrong place
We added two-factor authentication to staff admin accounts. Admin here is all or nothing: anyone holding it can read every customer record, so it is the account worth protecting with more than an email code.
We wired the check into the layer that handles admin data requests, shipped it, and moved on.
Then the founder set up his own authenticator, deliberately skipped the code at sign-in, and found he could still open admin pages and see what was on them. The check we had added covered the data endpoints and not a single page, and admin pages fetch their data by a different route.
Nothing had looked broken. The tests we wrote asserted that the check behaved correctly, and it did. Nothing asserted where the check had been installed.
It is fixed, and the fix is now enforced on every admin request rather than some of them. The reason we are telling you is that this is the failure mode worth being honest about: not a control that fails loudly, but one that works exactly as written in a place that does not cover the risk.
Uploads
Documents uploaded to the platform are now validated by their actual content rather than by what the file claims to be, images are re-encoded so anything hidden alongside the pixels does not survive, and formats that can carry macros are refused outright.
We chose that over a scanning service on purpose. A scanner would have meant sending traders' identity documents to another company to reduce a risk that cheaper controls already cover.
Consent for identity checks
Identity verification involves analysing a facial image, which is biometric data and needs explicit consent. Our wording said "complete identity verification" and never said the word biometric. That was not good enough, so we wrote what actually happens and asked, including asking the people we had already verified.
What is next
More of the record, and less of the paperwork around it.