The open-source build stopped pointing at our servers

PayGlue is source-available, and anyone can run it themselves. Until this release, an install that did so was quietly tied to ours. The snippet you copied out of your own dashboard carried our address, so your readers' browsers talked to our server instead of yours. The check that tells you whether the paywall is installed compared your site against our hostname, so it said no matter how correctly you had set it up. Your checkout could not finish, because the list of allowed return addresses was ours. And the welcome mail going to your customers was signed with our name. None of that was a decision, it was what happens when a product and its open-source build grow out of the same code without anybody checking which one a value belongs to. It is fixed, and this is the release where running PayGlue yourself actually means running it yourself.

• Embedded scripts work out their own backend from the tag they were loaded from, so nothing has to be configured and it stays right behind any proxy
• The installed check looks at the path, not at whose domain it is
• Checkout accepts your own dashboard as a return address
• Seeded emails carry no name and no links, and arrive switched off so you read them before your customers do
• No product analytics at all: no package, no key, nothing sent anywhere
• Six security advisories closed, none left open