Happy Friday people of Slipmat! We slightly missed the deadline for bigger updates this week due to life-related time constraints but we still have a ton of improvements to share with you. Let’s dive right in!
New Features
- Scheduled event page has an “Add to calendar”-button that adds the event directly to Google calendar or triggers a download for a .ics file that you can add to any calendar app (including iOS).
Enhancements
- Upcoming event page looks much better now and includes proper RSVP widget for Facebook-like event RSVPs (which are clearly visible on the artist dashboard as well). Proposed events also have now a much cleaner voting UI. Anonymour visitors see these widgets as well with a prominent “Log in to RSVP / vote” call to action buttons. Scheduled events are pre-scheduled for a reason – you should promote the URL and ask listeners to RSVP! The more visibility you get for the event, the more listeners you see as well
- HYPE count is now visible only when event is live (ie. not in warmup or ended)
- Artist social statistics are now collected weekly on Monday mornings (04 UTC) in addition to before and after scheduled events. This gives better visibility to social growth especially for those weeks you might need to skip a set.
- Common static assets (logos, background images, etc) are now cached better which makes the whole site snappier and faster, especially after first load. This calms down lots of the navigation and overall feeling.
- Refactored initial app load to not do stupid things and overall logging to be quieter. This refactor cleaned up initial page loads, made login page behave better and cleaned up default logging so that the data from normal browser logs is now much cleaner (and you still can enable debug logs to see much more details). This was a fairly big refactor touching a large part of website, chat and live pages. As we move towards public launch these kind of cleanups help finding relevant debug information from unwanted noise when developing and chasing bugs.
- As a security-hardening enhancement we now validate event recording embed-html to be allowed only from known providers (Mixcloud and Hearthis.at enabled by default) only. If you need other providers, just ask and we’ll add to the list. This allows adding very strict security policies for the event page so that a malicious artist (I really don’t see how this could be a thing in reality but when wearing a security hat it is so it is
) cannot add malicious code to the event page. - Added additional security hardening to the event recording and description fields as well. The backend now filters all submitted data more strictly.
- Public legacy event data now includes recordings and playlists as well.
Bugfixes
- Chat message sending is now much more reliable, especially with mobile clients. Failed messages will also produce a visible error so there is no situation where message can just disappear (this was an actual bug before). Unverified sent message shows slightly dimmer in the chat before it’s either showed properly or replaced with a clear error message and a retry button.
- Live page chat no longer scrolls to top when opening the hamburger menu.
Security
- Fixed a major issue with incoming email webhooks. This would have potentially allowed attacker to gain access to send emails from Slipmat.
- Fixed two minor SSRF (Server-side request forgery) issues regarding content fetching for preview generations (for example for chat link previews) that would potentially have allowed data fetching from private/internal sources.
- Hardened set-password API endpoint.
These issues were found and fixed by GPT-5.6 Sol (obviously with tight overview and verifications by myself).
Misc
- Backend API code was refactored to split 5 megalarge files into ~30 smaller modules to improve the architecture and to make development and testing smoother. These kind of refactors are possible because of our comprehensive test suite (over 1200 (!!) tests) and the continuous house cleaning makes it possible to keep the development speed fast.
- Built a migration tool for verifying that v2 URLs and v3 URLs match in terms of SEO. We strive for the new v3 pages being much better in SEO and looking much better in social previews than the current URLs. When all tested urls pass this tool tests, we are finally ready to launch
I’m really excited for the couple of next weeks – we have some really cool and fun things in the pipeline! Enjoy the music, peeps! 