Track every milestone in dTax's development — from core engine to full-stack tax platform.
Fixes a bug where transactions that were deleted from the UI still counted as duplicates when re-uploading a CSV. The original logic skipped matching rows regardless of delete status to avoid unique constraint violations — but that blocked users who intentionally soft-deleted and modified their CSV from seeing the updates take effect. Now the import path partitions matches into three buckets: active duplicates (skipped as before), soft-deleted matches (resurrected — deletedAt cleared, fields updated from the new CSV, AI classification and price enrichment reset so downstream jobs reprocess), and brand-new rows (inserted as before). The response now returns a `resurrected` count alongside `imported` and `skipped` so you can see exactly what happened. Reported by our very first paying customer; fix shipped within 24h of the report.
Major reliability update to subscription flow plus new admin capabilities. Billing: we identified and eliminated a scenario where a delayed subscription confirmation could lead to duplicate charges on retry. Three layers of defense now guard the checkout path — reconciliation with Stripe before creating any new subscription (heals orphaned active subs from past webhook failures), lifetime-plan protection (blocks duplicate PRO purchases for lifetime subscribers), and a same-plan duplicate guard that short-circuits checkout when an active subscription or active comp grant already exists. Any impacted customer has been made whole with full refunds. Webhook coverage extended to handle customer.subscription.created events, so subscriptions created outside the standard checkout flow (e.g., admin comp grants) now sync to our database correctly. Admin tooling: one-click 'Grant 12mo PRO' action creates a time-limited comp entitlement with auto-expiry and no auto-renewal — no Stripe subscription required. Permanent 'Delete user' action with typed-email confirmation and transactional cascade delete across all related records. Extended the admin subscription endpoint to accept currentPeriodEnd, cancelAtPeriodEnd, and explicit status fields for finer control. Fixed a label bug where subscription expiry was displayed as 'registration date'. Security: five new server-side gates on admin subscription endpoints prevent self-modification (segregation of duties), cap grant duration at 24 months (prevents runaway long-lived grants), reject past-dated expiry, protect active Stripe subscriptions from billing-field overwrites (prevents DB/Stripe drift), and require pre-existing lifetime entitlement for lifetime status elevation. Tests: 16 new cases covering all new defense and security paths.
Internal security hardening and reliability improvements. Security: password reset tokens are now stored as SHA-256 hashes — the raw token is never persisted to the database, eliminating credential exposure risk from a DB breach. SSRF protection upgraded to DNS-level hostname validation to block rebinding attacks (both IPv4 and IPv6 resolution). Content-Disposition filename injection prevented via header sanitization. Auth exemption paths use exact-match logic to close prefix-collision bypass. Reliability: duplicate sync/tax-calc job enqueue race condition eliminated using serializable PostgreSQL transactions. Price enrichment now processes DB updates in batches of 20 concurrent writes (prevents connection pool exhaustion on accounts with 10,000+ transactions). R2 report storage stream gains a 30-second stall timeout. Tax calculation worker gains a 5-minute hard timeout to free stuck job slots. Frontend: Firefox CSV, PDF, and JSON download compatibility restored (anchor must be in DOM before click). Tax polling interval cleaned up before each new calculation to prevent interval leaks on repeated triggers. Onboarding navigation migrated to Next.js router for correct locale prefix handling. Deleted report list now correctly refreshes to page 1.
Three UX improvements. (1) Tax calculation is now asynchronous — instead of blocking the UI, the engine queues a background job and shows a live progress indicator; results appear automatically when ready. (2) Multi-asset filter: the Transaction filter bar now shows a multi-select dropdown populated from your actual transaction history — pick BTC, ETH, SOL and more in one click instead of typing comma-separated tokens. Filter state is also restored from the URL on page load. (3) URL-persistent filters: every filter and sort setting is written to the URL query string, so refreshing or sharing a link preserves the exact view.
Two new free-tier analytics features. OFAC Sanctions Scan: automatically checks all connected blockchain wallet addresses against the US Treasury SDN (Specially Designated Nationals) list — updated daily, O(1) lookup, 24h cache. Flags sanctioned addresses with entity name and blockchain. Emotional Trading Patterns: detects buy-high/sell-low behavior from your own transaction history — weighted-average buy price baseline, chasing-high count, panic-sell count, emotional loss estimate in USD, and an emotional score 0–100. Both visible in the Tax and Analytics dashboards respectively, available on all plans.
CARF/DAC8 Exposure Scan (GET /tax/carf-exposure): scores each exchange by jurisdiction and CARF adoption status, estimates reportable transaction count and potential exposure level (NONE/LOW/MEDIUM/HIGH). India TDS Tracker (GET /tax/india-tds): calculates 1% TDS under Section 194S on transactions exceeding ₹50,000 — shows total TDS deducted, qualifying transaction count, and per-transaction breakdown. Three new Indian exchange parsers added: WazirX, CoinDCX, and ZebPay — bringing total dedicated parsers to 29.
Two new PRO report formats. Audit Defense PDF: a four-section IRS defense package — cover letter, executive summary, methodology attestation, and full transaction register. Designed to be handed directly to an IRS examiner. Holdings Snapshot PDF: a point-in-time proof-of-assets attestation with current unrealized gain/loss per asset, CPA signature block, and dTax methodology attestation — suitable for loan applications, estate planning, and audit prep.
Five new country-specific cost basis methods: AU CGT Discount (50% exemption for assets held >12 months), CA ACB (Adjusted Cost Base, 50% inclusion), KR Virtual Asset Tax (22% on gains above KRW 2.5M), IN VDA (30% flat + 1% TDS), ES CGT (19–28% progressive). Total methods now 13. Expanded i18n from 7 to 10 languages — French, Turkish, and German added. 991 tax engine tests passing across all methods and jurisdictions.
Wallet sync now supports Litecoin (LTC), Dogecoin (DOGE), Bitcoin Cash (BCH), and Dash (DASH) — bringing total blockchain support to 22 chains. Powered by Blockchair public API (free, no key required). All four chains support address auto-detection, UTXO balance calculation, and TRANSFER_IN/OUT/INCOME transaction classification.
Import transactions once — dTax handles everything automatically. After every CSV import, wallet sync, or exchange connection, price enrichment runs in the background, followed by automatic FIFO tax report generation for the previous and current tax year. A summary email is sent when your report is ready, showing net gain/loss per year. PRO users can re-run with LIFO, HIFO, or other methods from the dashboard.
Wallet sync integrity: Solana pagination (up to 12,500 txns), Moralis page limit 20→200 (up to 20,000 txns), EVM incremental sync with persistent cursor. Fee USD values auto-filled via price enrichment. Transaction hash column now shows clickable block explorer links. Hide $0 transactions filter added. Auto-trigger price enrichment after sync (5-min cooldown). Clear Data button per wallet — physically deletes imported transactions and resets sync cursor for full re-fetch. Dashboard workflow hints added.
Filter transactions by missing price (quickly find entries needing manual price entry), filter by multiple assets at once (e.g. "BTC, ETH, SOL"), and toggle optional Chain, Address, and Tx Hash columns in the transaction table. Transfers and Reconcile pages now paginate large result sets.
Two-sided transactions (trades, swaps, LP deposits) now display as "BTC → USDT" in the asset column. LOST and STOLEN types added to the transaction type list. AI assistant conversation history paginates (load more). Portfolio price refresh buttons show action tooltips. 7-locale i18n completeness pass.
Patched 4 security findings from an independent audit: quota bypass via targetUserId (H-1), expired CPA sessions no longer access data (H-3), account deletion rate-limited to prevent enumeration (L-3), and Stripe webhook userId validated against Stripe metadata (C-2).
Sync Bitcoin addresses directly — all 4 formats supported: Legacy (1...), Nested SegWit (3...), Native SegWit (bc1q...), and Taproot (bc1p...). Powered by Blockstream Esplora API — free, no API key required. Auto-detects mining income (coinbase transactions → INCOME), correctly handles UTXO change outputs for net-sent calculation, and falls back to mempool.space for reliability.
Connect exchange API keys (Binance, OKX, Bybit, Kraken, Coinbase, KuCoin, Gate.io) to sync spot trades, deposits, and withdrawals automatically. Plan-43 extends this to futures, perpetual contracts, and leveraged trading — including funding fees and liquidations mapped to the tax engine as MARGIN_TRADE and LIQUIDATION types.
Auto-classify LP tokens by protocol name (Uniswap V2 LP, PancakeSwap LP, Curve 3CRV, Balancer BPT, and 8+ more) as LP_DEPOSIT/LP_WITHDRAWAL. Custom EVM chain support for MetaMask-compatible networks with SSRF-protected explorer URLs. 26+ CSV parsers with new Bitstamp, Upbit, and Robinhood formats added.
17-chain support: ETH, Polygon, BSC, Arbitrum, Optimism, Avalanche, Base, Linea, Scroll, Mantle, Blast, Gnosis, Sonic, Monad, Sei, Cronos + Solana. Source/Chain/ContractAddress columns added to CSV export, import, and transaction list. User-controlled column visibility. Lifetime PRO plan (). BSC migrated from Moralis to Etherscan V2 for better reliability.
GENIUS Act stablecoin compliance section added to Features page and landing page comparison table. 7-method side-by-side comparison in simulator (expanded from 3). Regulatory blog series: GENIUS Act stablecoin tax, SEC/CFTC MOU asset classification, Clarity Act DeFi tax (3 articles × 7 languages). Report history now shows generation time on calculation. Homepage method selector includes UK Share Pooling. Roadmap: stablecoin payment instrument mode planned pending IRS guidance.
UK Share Pooling (Section 104) as 8th cost basis method, CARF 2027 countdown on tax page, CARF adoption status for 15 countries on global tax rates, CARF transaction data export endpoint (PRO/CPA), multi-provider AI system (15+ LLM providers with BYOK), AI operations console, subscription upgrade gating, and CARF content across all marketing pages.
3 international cost basis methods (Germany FIFO with 12-month exemption, France PMPA weighted average, Japan Total Average), 15-country tax rates comparison page, and 8 country-specific crypto tax guides.
Ordinary income reporting (staking/mining/airdrops), 1099-DA covered vs noncovered classification, PARITY Act regulatory alerts, and enhanced tax summary cards.
Added Pricing, Features, Security, and Exchanges pages with full i18n support.
Landing page, legal pages (Terms, Privacy, Disclaimer), and onboarding wizard for new users.
Marketing homepage with feature highlights, competitive comparison table, and pricing overview.
Dark/light theme toggle with system preference detection, responsive navigation, and error boundaries.
Quick action cards, data source overview widget, and a 3-step new user guide on the dashboard.
12 new DeFi/NFT transaction types, Etherscan and Solscan DeFi parsers, and wrap/unwrap basis passthrough.
20 exchange CSV format parsers including Coinbase, Binance, Kraken, and 17 more with auto-detection.
Form 8949 PDF/CSV export, Schedule D summary with loss carryover, and wash sale detection with 30-day window.
FIFO, LIFO, and HIFO cost basis calculation, CSV import pipeline, and basic dashboard with tax summary.
Tax engine with comprehensive unit tests, Next.js frontend with i18n, and Fastify API with Prisma ORM.