Progress
How this got built
Not a list of dates. The stages the product moved through, in the order they had to happen, with what each one changed and why it was needed.
- 01FoundationShipped
One endpoint that renders a page properly
The starting point was narrow on purpose: send a URL, get back an image of the page as a real browser drew it. Everything since has been built on that being reliable first.
- Captures run in real headless Chromium, so single-page apps and lazily loaded content are on the page before anything is read off it.
- PNG, JPEG and WebP from one endpoint, with device presets, custom viewports, and locale and timezone emulation.
- Element and full-page capture, so the result can be the part of the page that matters rather than a default viewport.
- 02ExtractionShipped
The response stopped being just a picture
Watching production traffic showed most requests were not ending in an image at all. Callers wanted the page's content and were writing code to carve it out of rendered HTML themselves — so that carving moved server-side, done once and deterministically.
- extractMarkdown returns the rendered page as tidy Markdown: headings, tables, lists, links and alt text survive; script soup, inline styles and hydration artefacts do not.
- Every extraction reports its own markdownMeta.estimatedTokens and a content-quality assessment, so the reduction is measurable per page instead of asserted.
- Semantic snapshots walk the accessibility tree and return scored selectors for each node — structure a model or a test can address, not a screenshot it has to guess at.
- Selector-based field extraction for the cases where you know exactly what you want off the page.
- 03DurabilityShipped
Jobs that survive the thing that runs them dying
One page is a request; a whole site is infrastructure. The work here was making a run that spans hundreds of pages behave correctly when a worker disappears halfway through — which is the normal case, not the exceptional one.
- Crawl and batch became durable workflows: per-child results, resumable parents, and webhook callbacks when a run finishes.
- A crashed parent job can be repaired by its own retry rather than needing a human to notice and restart it.
- Idempotency keys mean a resubmitted run is the same run, so a client retry cannot silently start a second crawl.
- Quota is charged when a child actually starts, never when a parent is created — a job that never ran costs nothing.
- 04PricingShipped
Prices moved onto measured cost instead of guesses
The top of the old price ladder was underwater and nobody had checked. Fifty real-world pages were captured in production conditions to find out what a capture actually costs: a mean of 19.1 seconds at 2048 MB per invocation. Every price on this site descends from that run, and it gets re-measured before the next repricing rather than trusted.
- Enterprise was rebalanced from an unlimited-retention plan sold below its own cost to a real ceiling with 365-day retention.
- Overage became metered on every paid plan, capped at twice the included quota — a runaway script cannot bill without bound.
- The free tier gained a hard stop rather than a surprise invoice: it can never accrue a charge.
- A renderer split moved capture off the orchestrator, which was billing idle wall-clock while it waited. Per-capture cost dropped about 25%, measured against real usage rather than estimated.
- Plan and retention facts moved into one source that the docs, the UI and the tests all read from, so a change is one edit everywhere.
- 05ContainmentShipped
Every browser launch goes through one boundary that fails closed
A rendering service runs untrusted pages by definition. This stage was about being able to prove what that browser can reach, and being willing to turn the product off until the answer was checked rather than assumed.
- Public capture was disabled outright while the egress position was audited, because the architecture documents described it as contained without being able to demonstrate it.
- Every browser launch in production now passes through a single authorization boundary that fails closed.
- The security-controls list was rewritten against actual measurements rather than intentions — several entries had described the plan, not the deployment.
- Alarm delivery without a durable record now reports as unconfirmed instead of as delivered.
- 06SurfaceShipped
A front end that describes the product honestly
The site was rebuilt around the four things the API actually does — screenshots, semantic snapshots, monitors, and durable crawl and batch jobs — with pricing rendered from the same plan data the dashboard uses, so the marketing page cannot drift from the invoice.
- Every capability has its own page, and the docs remain the single guide to the API.
- Light and dark themes across the marketing site and the dashboard alike.
- The playground runs a real capture without an account, so the product can be evaluated before it is signed up for.
- Marketing figures with no published methodology behind them were removed rather than restated — including a latency claim that contradicted the project's own measured capture times.
- 07In progressOpen
Where the work is now
Open, in the order it is being worked on. Listed here because a page about progress that only shows finished work is a brochure.
- Monitor capacity is behind launch controls while scheduled load is observed against the measured per-capture cost.
- Retention and erasure paths are being closed out end to end, so deleting an account provably removes its captures.
- The docs are being reworked against real reader questions; the feedback endpoint is the fastest way to change what gets written next.
Want to change what comes next?
The list above is shaped by what people tell us is missing. POST /feedback is free on every plan, including the free one, and the docs explain what makes a report actionable enough to reproduce the same day.
How to send feedback we can act on