ZIP deployments, object storage, and stronger account security

This update covers changes shipped October 5–11, 2026. It brings more ways to deploy and manage application files, alongside improvements to sign-in, service views, and build efficiency.

AddedCopy Anchor Link

• ZIP source uploads. Upload application source, review the detected framework and build settings, and select the archive for a service. Accepted archives remain reusable within their workspace, and deployments record the selected source revision. Saving a different archive does not replace the running application; deploy it when ready. Deploy from a ZIP.

• S3-compatible object storage. Create private buckets, issue read-only or read-and-write keys, and use S3-compatible clients to upload, list, and download application files. Temporary download links provide access to individual objects without sharing a bucket secret. Each workspace includes 1 GiB; an object can be up to 64 MiB. Use object storage.

• Optional website analytics. Enable browser page-view collection for a web service or static site, choose allowed origins and excluded paths, and install its script. Collection starts off, respects supported privacy signals, and can be disabled. Recorded events can also be erased. Configure website analytics.

• Visitor password protection. Require a password before visitors reach an application's routes. Password changes invalidate previous access once the routing update is applied, and the gate covers nested paths as well as the homepage. Manage visitor access.

• Managed application addresses. Web services and static sites receive addresses such as my-app.ostead.tech, with a suffix when needed for uniqueness. Openstead handles DNS and HTTPS, and existing generated addresses remain available as aliases. Assigned addresses stay stable across deployments. Use managed and custom domains.

• Passkey sign-in. Register a passkey from account security settings and use it for passwordless sign-in and identity confirmation on supported browsers and devices. Required workspace security checks still apply. Review account security.

ImprovedCopy Anchor Link

• Dashboard loading and navigation. Project and service data appears progressively, with fewer repeated requests. Signing in proceeds to the dashboard after any required security checks, and multiple console tabs avoid repeated refresh loops. Website navigation also reflects a confirmed console sign-in while preserving the dashboard destination. Organise projects and services.

• Next.js deployment efficiency. Supported standalone applications use smaller runtime packaging. Private dependency caches can be reused across source updates, reducing repeated installation work while each deployment retains its own application artifact. Build duration still depends on the application and its dependencies. Configure builds.

• Service views on smaller screens. Service lists, deployment details, and actions adapt more consistently to narrow viewports, with improved spacing and navigation. Manage web services.

• Guides for the new workflows. Documentation now covers ZIP source, object storage, analytics, starter configuration, and managed application addresses. These guides are also available through Markdown exports and documentation search. Browse deployment guides.

• Clearer pricing and renewal explanations. Pricing pages explain calendar-month paid terms, manual invoice renewal, workspace credits, and payment currencies more clearly. Review pricing and renewals.

• More direct contact and application routes. The contact page groups hosting and migration questions with support, documentation, and status links. The careers page groups founding-team opportunities and opens the matching application for each role.

FixedCopy Anchor Link

• Account recovery and two-factor changes. Recovery-code downloads and authenticator deactivation complete correctly when identity confirmation is required. Disabling TOTP preserves an existing passkey, and an expired confirmation can be renewed before completing the action. Manage account security.

• Independent HTTPS checks for application addresses. A problem with one attached custom hostname no longer blocks certificate requests for a service's managed address or retained aliases. Understand HTTPS.

• Consistent account-email authentication. Account verification messages now use the authenticated Openstead sending domain consistently. Messages include a plain-text alternative and links to the current Openstead addresses. Verify your email.