Changelog of shipped updates

August 2026Shipped

The public beta opens

Polymorfa is now open to everyone in beta: the sandbox is free with no card, and the full platform surface is live behind it.

API key scanning with GitHub

Through GitHub's secret-scanning partner program, keys that leak into public code are reported to us over an HMAC-signed webhook. We revoke the key automatically and flag it in your dashboard before anyone can use it.

Date-pinned versioning

The Polymorfa-Version system ships with the beta: pin a version date and your integration keeps working. Breaking changes only ever land behind a new date, with sunset headers in responses months before removal.

Scoped keys and client tokens

Three credential kinds, each with its own blast radius.

Team-scoped keys for organization-level automation
Project-scoped keys checked against 21 scopes before anything executes
Short-lived client tokens for frontends, never long-lived secrets in a browser

Improvements

The sandbox provisions fake numbers on Bartender with no SIM and no verification
MCP server exposed with 76 tools across 14 domains
HMAC-signed webhooks on by default for every project

June 2026Shipped

Internal beta at scale

The first internal beta ran with thousands of connected WhatsApp sessions, hardening the platform core before anyone else touched it.

Projects and numbers, end to end

The full project and number lifecycle landed across the console, the SDKs, and the desktop tools: create, configure, pause, and delete, with the same behavior on every surface.

Session engine under load

Reconnects, resume cursors, and ordered webhook delivery proven against real fleets of concurrent sessions.

What shipped.