Where ResetKit Stands

ResetKit relaunched two weeks ago. People are reading the docs, a few have signed up, and we have shipped something almost every day since. This is the status report we would want to read before building on somebody else's service: what works, what broke, what we did about it, and what is coming.

What works today

Everything on the pricing page is live, and all of it is free right now.

Password reset. One script tag on your forgot-password page, two webhooks on your backend. Codes are hashed before they are stored, rate limited on every layer, and the flow gives an attacker nothing to learn about which emails have accounts.

Two factor. Email codes and authenticator apps, on the same connection, with the same attempt limits and lockout.

Magic links. Passwordless sign in for your users.

Sign-in links for your own apps. This is the newest piece. Any app you own can send a sign-in link through ResetKit, and when the person clicks it your backend receives a short-lived, signed assertion it can verify in a few lines. No sessions to share, no identity provider to configure. The docs walk through it end to end.

Signed webhooks, branding, a dashboard. Every webhook carries a signature you can check. The emails carry your name and colours. The dashboard shows what happened and when.

What broke

Two things, and both got their own post at the time because we would rather you hear it from us.

The first was outbound email. A misconfiguration meant verification links, codes and sign-in links did not arrive for a stretch, and our own status check said everything was fine because it was checking whether a credential existed rather than whether it worked. That is fixed. The check now says "configured but not verified" until a real delivery has proven otherwise, and there is a test that sends an actual message on demand.

The second was the database, early on. The service was up and the database was not, which is a worse combination than both being down, because the site looked healthy. The API now starts even when its database is unreachable, reports that state honestly on its health endpoint, retries in the background, and refuses to pretend. A startup check also catches the class of configuration mistake that caused it before the service will boot.

Neither should have happened. Both are now the kind of failure that gets caught rather than the kind that gets discovered.

What we did with the quiet weeks

A full security review of the API, top to bottom. We wrote up how we approach that work and why we do not publish the findings. The short version is that every issue it turned up was fixed the same night, and each fix has a test that fails if the behaviour ever returns.

Crypto billing that keeps no trace of who paid. Payments are matched to accounts by a keyed reference rather than by anything that could identify a wallet, and the plaintext never touches our storage. That one has its own post too.

A test suite that runs on every change before it can merge, and a dependency inventory that currently reports nothing known to be vulnerable.

Today: the site on phones

The marketing site did not look right on a phone. Headings were sized for a desktop, the top of every page was tucked under the navigation bar, and a few pieces of copy still promised a fourteen-day trial that no longer exists. All of that is fixed as of this post, and the copy now says what is true: free, no card, no clock.

If something still looks off on your device, a screenshot to support@resetkit.dev is genuinely useful.

What is next

Card payments switch on. The prices will not change from what is on the pricing page, and you will get notice before anything is charged to anyone.

External monitoring that pages a person when something fails, rather than waiting to be noticed.

Team access on the higher plans, and more worked examples in the docs for the sign-in link flow.

We are not going to list a longer roadmap than that, because we would rather ship three things than promise ten.

If you are deciding

Sign up, put it in front of real users, and tell us what confused you. That feedback is worth more to us right now than a subscription would be, which is the whole reason it is free.

Write to support@resetkit.dev. It reaches a person, and that person reads it the same day.