Changelog

LARP has its own domain

The site lives at larp-bio.xyz now. Your page, your aliases and every link you have already handed out all work there.

• —larp-bio.vercel.app keeps working and always will — the same site, reachable both ways, so nothing you have already shared goes dead.
• —www.larp-bio.xyz sends you to the short version, so there is one address to remember rather than two.

Pay with cash, put your Discord on your page, and six more panels

Premium and alias slots can be bought with paysafecard — the only method here, on purpose. Your Discord account gets a widget of its own. And the catalogue reaches forty-two.

• —paysafecard and nothing else. You buy one with cash over a counter, so paying needs no bank account and no card in anybody's name. For who uses this site, that is the difference between being able to pay and not.
• —The 16-digit PIN is typed on paysafecard's own page. It never reaches this server, is never stored, and no admin here could read one.
• —Money is only taken after the payment is captured, and only then is anything granted — a reservation that is never captured is money that quietly comes back days later to somebody wondering what they bought.
• —Discord account is now its own widget: put in your user id and it shows your username, avatar and the badges Discord draws on your profile. People kept typing their id into the server widget, which wants an invite code.
• —Six more panels: who won the last Formula 1 race, the latest earthquake above a magnitude you pick, and your favourite anime, song and show.
• —Favourite anime runs on AniList, not MyAnimeList. Jikan was the obvious choice and answered 504 on four probes across two sittings; AniList answered every time.

Drawn marks, six more panels, and a screen that stops you

Emoji are gone from the widget cards and the Discord badges. Six new panels arrive, Roblox shows your actual avatar, and anything that sends you mail now says so in a way you cannot scroll past.

• —Every card mark is drawn now — a real sun, a real cloud, a brand logo where one exists. Emoji rendered as a different picture on every operating system and could not take your accent colour.
• —Roblox shows the avatar Roblox renders for you, not a coloured square. Minecraft players show their skin's face, Pokemon their sprite, Duolingo their character.
• —Six more: a Minecraft player, a Twitch channel's followers, a Pokemon with its base stats, Hacker News karma, the whole crypto market's value, and your Duolingo streak. Thirty-six in all.
• —Signing in, resetting a password, changing an address or confirming one now open a panel that says to go and read your email. It says so plainly when the message could not be sent, rather than leaving you waiting for one that is not coming.
• —Security grew an email section. Whether your address is proven belongs next to your password, because a reset link is only worth as much as the mailbox it goes to.
• —Your aliases are on the Overview screen with a copy button, next to your page link and your UID — the short name is the one people actually get handed.

Steam by name, Discord badges, and a catalogue you can read

Three fixes to the panels: the one that did not work now does, the picker stops being a wall, and every field tells you where to go and find what it is asking for.

• —Steam took a numeric app id and nothing else, which made it read as broken. Type Counter-Strike 2 now — the name is looked up for you, and an app id or a pasted store link still work.
• —Your Discord card shows the badges Discord itself draws: Early Supporter, the HypeSquad houses, Bug Hunter, Active Developer, staff and partner marks. Hover one for its name.
• —Nitro is not among them on purpose. Reading it needs a permission this feature does not ask for, and guessing it from an animated avatar would be a guess dressed as a fact.
• —The widget picker collapses into its five groups with a count on each, so thirty choices are a list rather than a wall. Searching opens whatever it matches.
• —Every widget now carries a link to where its value lives — CoinGecko's coin ids, the list of time zones, the profile page where your Stack Overflow number hides in the URL.

Thirty widgets, and a preview that sits beside you

Nine live panels became thirty, sorted into Gaming, Developer, Money, World and You. Twelve fit on a page now instead of eight, and the preview moved to where you can actually see it.

• —New in Gaming: your Discord server's member count, Lichess, Roblox, Speedrun.com, Modrinth downloads and Old School RuneScape hiscores.
• —New for developers: a single GitHub repo's stars, PyPI, crates.io, Docker Hub pulls, Stack Overflow reputation, Codeforces and GitLab.
• —New elsewhere: exchange rates, the crypto Fear & Greed index, air quality, sunrise and sunset, where the space station is, a country's population, Wikipedia readers — and a countdown to any date you name.
• —The preview now sits beside the picker rather than under it. With thirty to choose from, a preview below the fold is a preview nobody scrolls to. The eye beside a saved widget previews that one.
• —The picker groups and searches, because thirty buttons in a wall is not a list anyone reads.
• —Two were built and thrown away for failing on a live call: Reddit answers 403 to anything from a datacentre, and every version of restcountries now returns a deprecation notice instead of a country. The country widget went to the World Bank.

Nine live panels for your page

Weather where you are. Players on your Minecraft server. Your GitHub, a coin, a clock in another country. Up to eight of them on one page, refreshing while somebody reads it.

• —Weather, Minecraft server, GitHub, crypto price, local time, AniList, Chess.com, Steam player counts and npm downloads.
• —Every one of them works with no setup. That was the rule the list was picked against — a widget needing a key the site does not have is a widget that renders an apology.
• —One box per widget: a city, a server address, a username. Try it before you add it, and the preview comes down the same route a visitor uses, so it cannot show you something different.
• —A mistyped city says so on the card. One service being down costs one panel, never the page.
• —Data is cached by what was asked rather than by who asked, so two people watching Berlin is one call out.
• —Reddit was built and then dropped: its public JSON now answers 403 to anything calling from a datacentre. Steam took the slot.

Your Discord account, live, on your page

A Discord link used to be a link — an icon that took someone somewhere else. It is a panel now: your name, your avatar, the coloured dot, and whatever you are playing, updating while the page is open.

• —Connect through Discord itself where the site has credentials for it, or paste your user id. The id is not a weaker feature, it is a weaker claim, and the screen says so.
• —The status dot comes from Lanyard, which only knows accounts that have joined its server. Until yours has, the card shows the account without a dot rather than guessing that you are offline.
• —Spotify gets its own line, with the track linked. A game shows what you are doing and how long you have been at it.
• —Three switches: hide the panel, drop the dot, drop the activity line. And a choice of under your bio or below your links.
• —Visitors look your card up by your page name, never by a Discord id — otherwise the route would be a free Discord lookup for anyone who found it.

Copy an alias without retyping it

An alias is a name you hand to people, and the dashboard made you select it by hand and remember what to put in front of it. Each one has a copy button now, and it gives you the whole link.

• —Copy is offered only for a name the server has accepted. A half-typed box is not a page yet, and a link to it would be a 404.
• —The offer of another alias is on the screen at all times, with what it costs, instead of appearing only on an account that has never had more than one.

Confirm your email without waiting to sign in again

Signing in proves your address every time — but only once you have signed out and back in, which left a new account unconfirmed for as long as its session lasted, with nothing to do about it. Profile now has a button.

• —Your address shows Confirmed or Not confirmed next to it, and an unconfirmed one offers to send a link. Opening it is the whole job; nothing about the account moves.
• —That mail says so, rather than borrowing the wording of an address change — a message announcing a change you did not ask for reads as an alarm when nothing is happening.
• —Confirming an address change now counts too. Following a link that only reached the new mailbox is the same proof as typing a sign-in code, and it was not being recorded.
• —An admin moving an account to a different address clears the confirmation with it. The old one said a mailbox had been reached; the new one has not been.
• —Three requests an hour, and a link that expires after a day.

Every sign-in now goes through your inbox

A password was the whole door. Now it is the first half: entering the right one sends a six-digit code to the address on the account, and typing that back is what finishes the sign-in — and what makes the address verified in the first place.

• —The code lasts ten minutes and works once. Five wrong guesses burn it and the sign-in starts over, which is what stops guessing spread across many machines.
• —The screen tells you where the code went with the middle of the address blanked out. Somebody holding a stolen password should not learn your email from the page it lands on.
• —Send another gets a fresh code and retires the previous one. Three of those in fifteen minutes, and ten codes an hour per account, so nobody can use your sign-in page to fill your inbox.
• —An authenticator, if you have one, is still asked for afterwards. Passing the mailbox does not excuse the stronger factor — and a reset link cannot be used to get around it either.
• —Each step carries a ticket signed for that step alone, so the one from the email screen is refused at the authenticator screen and is worth nothing as a cookie.
• —Deployments with no mail configured at all skip the step rather than locking everyone out. If mail is configured and a send fails, the sign-in fails honestly instead of quietly waving you through.

Staff can sign profiles and hand out alias slots

Two more of the things moderators were escalating to an admin. Both stop well short of the admin version of themselves.

• —Signing a profile, the same seal the admin panel grants. It carries the name of whoever signed it, publicly, so putting your name to something is a decision made in the open.
• —Alias slots, up to three. Admins can go to twenty-five; three is enough to be a courtesy without being the paid upgrade. Lowering a count drops the aliases it no longer covers rather than leaving them stranded.
• —Neither works on an account that is on the team. That has been true of every staff action from the start.

Your seal, your call on where it goes

A signature is granted by staff but displayed by you. It always sat under the name at one fixed size; now Appearance decides both.

• —Three positions: under the name, under the bio, or in the footer above the view count.
• —A size slider from 70% to 160%. Every part of the seal scales together — icon, text and padding — rather than being stretched, and the space it takes up shrinks with it instead of leaving a gap where the old one was.
• —Staff can still only grant or remove a seal. What it looks like on your page is not theirs to set.

The staff panel stops being one long column

Four jobs stacked on top of each other meant scrolling past three of them to reach the fourth. Managing an account is now four tabs.

• —Aliases, Badges, Signature and Names, each its own tab, opening on the one you probably want.
• —A Signed filter next to the others, a slot count on every row, and press / anywhere to jump to the search box.
• —The empty state offers to clear the search that caused it, instead of leaving you to work out why the list is blank.

The Staff badge is the staff panel

Access used to be a hidden flag on the account, separate from the badge people actually wear. Two things meant to say the same thing, able to disagree. Holding the Staff badge is now the whole grant — there is nothing else to keep in step with it.

• —Give someone the Staff badge and they have the panel; take it off and they do not. Either gesture works, from the Make staff button or from the badge grid, because they now do the same thing.
• —Access is decided fresh on every request, so removing the badge closes the panel on the next click rather than at the end of their week.
• —Nobody can hand out the Staff badge from inside the staff panel. It is not on the list of six, so staff cannot recruit staff.

Staff can hand out six badges, and take down a name

The panel could give exactly one badge and could not touch a username, which left the two things moderators actually get asked for — crediting a bug report, and getting a slur off the site — sitting in the admin queue.

• —Six badges: Early User, Bug Hunter, Bug Hunter Pro, Suggestor, Donator and Rich. Every one of them records something a person did. Verified, Premium, Partner and Staff are claims about who someone is, or hand over access — those stay with the admins, and the panel refuses them outright rather than hiding the buttons.
• —Renaming an account, for a username or display name that cannot stay up. It needs a written reason, which goes into the audit log next to who did it.
• —The person is emailed that their name changed, from and to, because otherwise they find out from a link of their own that no longer works. The mail carries no reason — that is for the team, not an argument to reply to.
• —A rename reaches the two names a visitor sees and nothing else. Email and UID are the other things that form can change, and both are routes into an admin account, so neither is passed through from here at all.

The staff panel, properly built

It was a list and a search box. It is now something you can actually work in for an hour without fighting it.

• —Members: filter by everyone, has an alias, suspended or team; sort by newest, oldest, most viewed or A–Z; avatars, badges and aliases on every row; and a count of how many of the total you are looking at. Long lists draw twenty-five at a time.
• —Team accounts are marked and locked in the list rather than failing when you press the button. The badge is public, so saying so discloses nothing the row did not already show.
• —The overview gained a thirty-day signup chart, a bar per badge showing how many people hold it, and per-card context — members with today's signups under it, views with the average, badges with the catalog size.
• —Every panel action now says what happened in plain words: which aliases an account ended up with, which badge moved, what the account was renamed to. Failures come back red instead of silently doing nothing.

A staff panel you can hand to someone else

Helping out meant an admin account, and an admin account means every email address on the site, every ban, every deletion. There is a second panel now at /staff that does two jobs and knows almost nothing — so the people who hand out aliases no longer have to be trusted with the rest.

• —Staff can assign aliases and grant the Early User badge. That is the whole list. No verification, no premium, no bans, no password resets, no deletions.
• —The panel is served by its own endpoint, and that endpoint answers with an allowlist of fields rather than a filtered account. Email addresses, password state, two-factor state, ban reasons and the flags saying who is admin or staff are not in the payload at all — so there is nothing to accidentally render, and searching by address is impossible rather than merely hidden.
• —Staff cannot act on an admin or on each other. Aliases still cost a slot, and slots stay something only an admin grants, so nobody can quietly hand out the paid perk.
• —Turn it on per person from Admin → Users with Make staff. Taking it back drops their sessions immediately rather than at the end of the week.
• —The admin panel is untouched. Admins can open the staff panel too, if only to see what their team sees.

Forgotten passwords have a way back

There was none. A forgotten password meant asking an admin to set a new one by hand, which is both slow and a worse idea than it sounds — somebody other than the account holder ends up knowing the password.

• —Forgot your password? on the sign-in page sends a link that is good for one hour and works once.
• —Only a hash of each link is stored. The mail is the one copy of the secret that exists, so a dump of the store cannot be replayed into anyone's account.
• —The answer is the same whether or not the address belongs to anybody, so the form cannot be used to test which addresses are registered. Suspended accounts get no link at all.
• —Using a link signs out every device, including whoever caused you to need it, and asking for a new link retires the previous one.
• —Setting the password does not sign you in — you sign in afterwards, which is where a second factor is still checked. A reset is not a way around 2FA.
• —You are told afterwards by email that the password changed, so a reset nobody asked for does not pass unnoticed.

The emails look like the site now

Mail from LARP was a dark box with a paragraph in it. It is a proper piece of design now, and it carries a plain-text version that cannot drift out of step with the HTML one.

• —A gold rule over the card, a labelled heading, a lead paragraph with real hierarchy, a pill button, and a row of facts — who the message is about, and how long the link lasts.
• —Every message now also goes out as plain text, built from the same content as the HTML. That costs nothing, helps deliverability, and means a client that refuses HTML no longer shows an empty message.
• —Still tables and inline colours throughout, because Outlook renders mail through Word and would otherwise turn the dark card into grey text on white.

Both panels count more than three things

The admin overview knew the number of accounts, badges and views. It now also knows how fast that is moving, and the staff panel is served the very same numbers so the two can never disagree.

• —New today, this week and this month, average views per profile, badges actually awarded, how many hold Early User, how many have an alias, and how many accounts are suspended.
• —The staff overview adds a most-viewed list with a bar per profile — the same data the public leaderboard already publishes.
• —One function computes all of it, so a number shown in one panel is the number shown in the other.

Name your own track

The field for naming your audio existed, but it sat in the Player tab between the visualiser colour pickers — nowhere near the Media tab where you upload the file. It is under the upload now, and the automatic name it falls back to is worth having.

• —Track Title moved to Media, directly under Background Music, and it tells you what the automatic name would be so "leave it empty" is a real choice rather than a guess.
• —Uploads keep the name you gave them. They were stored as a timestamp and a random id with the original thrown away, so an unnamed track showed up in the player as "a1b2c3d4" — the random half. New uploads carry a readable version of your file name, accents and all.
• —Tracks uploaded before this still have nothing to read, so they say "Now playing" instead of showing an id. Naming them by hand works as it always did.

Address changes are confirmed by real email

Changing your email said a confirmation had been sent. Nothing had been: no mail server was configured, the failure was swallowed, and in production there was no token on screen either — the flow was a dead end.

• —Confirmations and delete tokens are sent from larpbioo@gmail.com. Host, port, user and sender all default to that account, so the app password is the only thing that has to be supplied.
• —The mail looks like the site rather than a bare paragraph, and carries both a confirm link and the token.
• —Opening the link fills the token in for you. It stops short of confirming on its own — links in a mail client are followed by scanners as well as by people, and a change of address should not fire on a preview fetch.
• —If the mail cannot be sent, the page says so and shows the token, so the change can still be completed instead of silently going nowhere.

The reveal screen gets two new looks and a way in

Only the way out of the reveal screen was ever animated — it appeared at full strength over a page that had not finished painting. It has an entrance now, the spotlight follows the pointer, and there are two more looks to pick from.

• —Iris: the page opens as a circle from exactly where you clicked. The overlay stays opaque and its clip closes instead, so the profile is cut open at the point you touched rather than faded through.
• —Glitch: the prompt tears and reassembles, coloured from your accent rather than the site's gold.
• —The spotlight follows the pointer instead of sitting dead centre. It is moved with a transform rather than repositioned, so tracking costs a composite and not a full-screen repaint, and it stays put on touch, where there is no pointer to follow.
• —The backdrop fades and the words rise on the way in.
• —Fixed: pressing Shift, Ctrl or Cmd on its own dismissed the screen, and so did browser shortcuts like Ctrl+R. Any real key still opens the page, so nobody is stuck behind it.
• —Fixed: with reduced motion turned on, the spotlight was parked at the middle of the window rather than the middle of the overlay — visible as a pool of light nowhere near the words in the dashboard preview. Where the light sits is layout; only following the pointer is motion, and only that is skipped now.

The spare databases are standby copies now

Three Postgres providers are attached to this project and one held everything. The other two were reachable and empty, which is a connection rather than a use. They keep warm copies of the accounts now.

• —Admin → System & Storage lists each standby with how many accounts it holds and when it was last copied, and a button copies the accounts and every site document across.
• —Losing the primary becomes a change of connection string rather than a restore from a backup that may or may not exist.
• —Copying is on demand, never on a signup. Writing every account change to several providers would put someone else's outage on the critical path of registering, and a copy a few hours old is worth more than a signup that fails because a standby was slow.
• —Pooled and direct connection strings for the same database are recognised as one, so a copy is not written twice to the same place.
• —Every store with credentials is now connected and doing something: two Postgres providers hold the accounts, a third and MongoDB back the media chain, and nothing is attached without a purpose.

Room to grow: four more places media can go

One store filling up should never be the thing that stops an upload. The chain is now a register of stores rather than a hard-coded pair, so capacity is a matter of environment variables — and adding a provider needs no code change and no deploy.

• —Four S3 slots are read instead of one. Anything S3-compatible joins the chain: Cloudflare R2 and Backblaze B2 both give 10GB free, and Wasabi or a self-hosted MinIO work the same. Slot one keeps the plain AWS_* names, the rest are numbered.
• —MongoDB GridFS is in the chain as the reserve. It has no browser-direct upload, so anything stored there has to pass through a function and a serverless body caps out around 4.5MB — it takes small files when everything roomier is full, and says so in the panel rather than accepting a video it cannot serve.
• —Private stores are addressed by name now: /api/media/<store>/<file>. With more than one of them, the URL has to say which holds the object.
• —The admin overview leads with how much is actually free across every reachable store, and only counts stores that are reachable — a suspended store's headroom is not usable space. How much is sitting in it is still shown, because that is the useful thing to know about it.
• —An upload that no store can take now says so plainly, instead of failing somewhere further down with a generic error.

Storage that does not depend on one store staying up

The Vercel Blob store was suspended for inactive billing. A suspended store keeps answering its metadata API while every object returns 403, so listing worked, uploads did not, and every avatar, background and audio file on the site went dark at once. Media now has three places to go instead of one, and the admin overview shows how full each of them is.

• —Uploads go to the first store that is reachable and still has room: Supabase Storage first, then Neon Object Storage as the spillover. Running out of one no longer means running out.
• —Supabase and Blob hand out public URLs, so profiles load those straight from a CDN. Neon's objects are private, so they are streamed back through /api/media/… — a presigned URL would expire, and an avatar's URL is written into the profile and has to keep resolving.
• —Vercel Blob comes back automatically on 2026-09-16, when its billing resumes — but only if it is genuinely serving objects again. A store that is still suspended on the day stays out of the chain rather than being promoted back to first choice and breaking uploads a second time.
• —Admin → System & Storage now lists every store with a usage bar, how much is free, which one is taking uploads, and which is on standby. The limits shown are the plan allowances from the config: no provider reports remaining quota over an API.
• —Files too large for a serverless body still never pass through a function. The browser gets a one-shot upload URL for whichever store is in front, and the dropzone reports real progress instead of a frozen label.

Every connected database actually connected

Three Postgres providers were attached to the project at once — the Neon store holding the accounts, a second Neon from the marketplace, and Supabase — and each integration writes its own variable names. The app only ever read one of them, so the rest were connected in name only.

• —One Postgres layer picks the connection string and the matching driver together, so Neon and Supabase both work. They do not share a protocol: Neon's serverless driver speaks its own SQL-over-HTTP endpoint and cannot reach any other host.
• —Supabase connections failed on their certificate chain until node-postgres was told to read sslmode the way Postgres defines it. A string asking for verify-full still gets a fully verified chain.
• —The live store stays first in that order on purpose. The others are empty, and preferring one would not have failed loudly — it would have served a site with no users on it.
• —A database connected from a host dashboard arrives with no tables. The first query that hits a missing table creates the schema and retries, so connecting one no longer means running a migration script by hand.
• —Site settings, the badge catalog and the audit log moved out of blob storage into the database that already holds the accounts, so they survive a media store going away.
• —/api/health opens every connected database and storage bucket for real and reports what happened. That is what found the suspended store: everything looked configured right up until something asked for an object.

Uploads capped at 50MB

Backgrounds were allowed 100MB, which is what set the storage bill and how long a profile takes to paint on a phone. It is 50MB now, and the cap is enforced in one place rather than trusted to each upload type.

• —No upload type can exceed the ceiling: the limits are clamped centrally, so raising one in isolation cannot quietly raise the real maximum.
• —The dropzone checks the size before sending anything, so an oversized file fails instantly instead of after the browser has pushed it at storage.
• —An upload that fails now says why — too large, wrong type, storage suspended — instead of replacing every large-file error with a guess about Blob setup.

Real pages on the homepage, and a calmer credits page

The homepage showcase was four invented cards, which is the one thing a bio-link site should never fake — anybody can click through and check. It shows actual pages from the site now, rendered by the component that renders them publicly.

• —Live profiles on the homepage: their colours, card style, badges, links, player and background, with the box tilt running. Click through to open the page.
• —The card is loaded on demand rather than bundled into the homepage's first paint — it drags in the audio engine, the particle field and the cursor layers.
• —New Featured Profiles setting in Admin → Site & Legal. The showcase renders whatever its owners wrote on their pages, so there is now a way to say which ones belong on the front page. Empty keeps the automatic pick of the most-viewed pages that have something on them.
• —Credits: flexbio.link takes the full row as the page's headline, each card lifts into its own project's colour, and the four arrive on a stagger.
• —Fixed invalid markup on the homepage showcase — the card was wrapped in a link around the profile's own links, which nests anchors and hydrates with an error.

A credits page, and a homepage that shows the product

LARP exists because flexbio.link existed first. There is a page for that now, and the homepage finally shows what a profile looks like instead of describing it for four screens.

• —New /credits page crediting Pajak (Franek) — flexbio.link, his portfolio at franekk.com, NexoraCode and NexoraGuard, with his flexbio page, his page here, and the flexbio Discord.
• —Every banner on it is that project's own artwork, stored locally rather than hot-linked, and re-encoded from 3.5MB of PNG down to 84KB of WebP.
• —The homepage has a live demo card that cycles through four looks — Luxury, Neon, Mint and Ice — and switches on click. Colours, corners, effects, socials and the player all change with it.
• —The claim box now checks the name while you type. It used to accept anything and only tell you the name was gone after you had signed up for it.
• —"Inspired by flexbio.link" in the hero and the footer now links to the credits page.

Two previews, 304 platforms, and 11 more animations

Showing the reveal screen in the preview created a new problem: with one turned on, the overlay covered the preview permanently and there was no way to see the page behind it. The preview now has two views and you switch between them.

• —Preview switches between Page and Reveal screen. The toggle only appears once you have a reveal screen turned on.
• —79 more platforms, for 304 in total. New groups: Podcasts, Linux & open source, Privacy & security, Files & notes, and Boards & tasks.
• —A Popular shortlist sits at the top of the picker and starts open. At three hundred platforms the dozen anybody actually reaches for were spread across a dozen collapsed headers.
• —Six more name effects: Type loop, Melt, Sheen, Spotlight, Jitter and Emboss.
• —Five more link animations: Slide, Border sweep, Press, Tilt and Underline.
• —Homepage shows the logos rather than claiming them — 36 real marks, with the platform count read from the catalogue so it cannot go stale. The old proof strip was still advertising 12 themes.

The reveal screen you can actually see, 225 socials, and 12 new animations

The live preview was hiding the two things hardest to set up blind. The reveal screen was skipped there entirely and the floating player was hidden, so the one screen with its own settings was the one screen you could never look at while building it. Both show now.

• —Reveal screen: a second line, four looks (minimal, card, spotlight, curtain), its own prompt colour, an icon (play, lock, sparkle, arrow), backdrop darkness, blur radius, and a switch for the breathing prompt.
• —The reveal screen appears in the live preview and stays put instead of vanishing on the first click — you are configuring it, not visiting it.
• —The floating music player shows in the preview too. Picking that position used to make the player disappear from the preview completely.
• —Replay button over the preview. An entrance animation plays once and is invisible for the rest of the session, which is exactly when you are trying to choose one.
• —Six new name effects: Shimmer, Scanline, Chromatic, Breathe, Stretch and Drift.
• —Six new card entrances: Rise, Drop, Zoom, Flip, Unfold and Swing.
• —55 more platforms, for 225 in total, including a Money & markets group (Wise, Revolut, N26, Monzo, Robinhood, TradingView) plus Gitea, Forgejo, Jenkins, CircleCI, Postman, JetBrains, Neovim, Raspberry Pi, HackerOne, TryHackMe, Hack The Box, Threema, Element, Session, Guilded, TeamSpeak, Plex, Jellyfin, Kodi, Sketchfab, Printables, Kickstarter, Product Hunt, Quora, Zhihu, Douban, Pixelfed, PeerTube
• —The picker groups collapse. 223 logos in one grid was a wall; a group now opens on click, shows a count and a preview of what is inside, and the group holding your current pick opens itself.
• —The effect and animation menus are built from the same list the page renders from, so a new one can no longer be missing from the dropdown.
• —A typewriter on the homepage that shows what a page actually does, next to the sign-up button.

The player runs for everyone, and 24 dials to shape it

The visualiser used to hold a flat line for any visitor whose system asked for reduced motion — including anyone who ever switched off Windows animation effects. That made a working player look broken, with nothing on the page to say why. It runs whenever a track plays now, and everything it does is a setting you can see and turn down instead.

• —New Player tab in Appearance, holding every music setting in one place instead of three.
• —Visualiser colour and a second highlight colour, for tips, crests and cores — the spectrum can be a gradient now. Leave either empty to follow your accent.
• —Dials for glow, beat strength, density, height, smoothing and radial spin. 100% on each is exactly what the player did before, so nothing changed on its own.
• —Panel looks: glass, solid, outline, or none at all. Plus corner radius and opacity.
• —Switches for the title, progress bar, skip and repeat, volume, panel sheen, beat flash, reflection, peak caps, beat rings and the wave trail. Hide any of them and the row goes with it.
• —Your own name for the track instead of the file name, repeat on by default, and a skip distance between 5 and 60 seconds.
• —The visualiser now runs under reduced motion. It is one small canvas, it moves nothing else on the page, and it stops the moment the audio pauses or the tab goes to the background.

170 platforms, crypto included, every logo the real one

The social picker went from 58 platforms to 170, and every brand mark is now generated from Simple Icons instead of drawn by hand. A redrawn logo looks like the real thing and is not, which is the kind of detail a brand notices before you do.

• —Crypto and web3: Bitcoin, Ethereum, Monero, Solana, Cardano, XRP, Litecoin, Dogecoin, Polkadot, Polygon, Stellar, Zcash, Dash, Bitcoin Cash, NEAR, Algorand, Chainlink, Tether, plus Binance, Coinbase, KuCoin, OpenSea, Blockchain.com and Trezor.
• —New groups throughout: Lemmy, Odysee, Rumble, bilibili, Crunchyroll, Tidal, Last.fm, Beatport, Discogs, Epic Games, PlayStation, itch.io, Lichess, Chess.com, Codeberg, Hugging Face, LeetCode, pixiv, VSCO, Unsplash, Substack, Notion, IMDb, MyAnimeList, Goodreads, Etsy, Fiverr, Coursera, ORCID, Garmin, Untappd, Liberapay, GitHub Sponsors, Keybase and more.
• —Every logo comes from Simple Icons at build time. The build fails rather than shipping a mark that does not resolve, so an icon can never quietly be the wrong one again.
• —Hovering an icon in the dashboard picker now names it, and the picker has a search box that also matches a group name, so “crypto” finds coins that never carry the word themselves — 168 logos is more than anyone scans.
• —Icons load as files rather than being bundled into the page. A profile shows about five of them and would otherwise have been charged for all 168 — 160KB of path data.
• —The URL box now refuses an identifier pasted where a link belongs. A Discord user id or a wallet address used to be saved as a link to a host that does not exist, and only failed when a visitor clicked it.
• —Two more lines in the rotating headline on the homepage.

Admins can correct a username, display name, email or UID

Everything that identifies an account was fixed at signup and could only be changed by deleting and starting over. The admin panel can edit it in place now, with the checks that make that safe.

• —Username, display name, email and UID are editable per account from Admin → Users.
• —A username still has to pass the rules signup applies, and has to be free across both usernames and aliases — an alias someone else holds counts as taken.
• —A UID has to be a positive whole number nobody else has.
• —UID 1 is the owner and the role follows it, so it cannot be handed to another account, and the owner cannot be moved off it and leave the site with no owner. The configured admin address is protected the same way.
• —Every edit is written to the audit log with what it was before and after.

The player hits on the beat now, and there is a fifth look

Every look is driven by the kick as well as the level, so the player moves with the track instead of just following how loud it is.

• —Beat detection. The player finds the kick by comparing the bass against its own recent average, so it adapts to whatever you are playing instead of needing a setting.
• —Radial — a new look. A ring of bars around a core that swells with the bass, spins slowly, and lurches forward on every beat.
• —Spectrum gained peak-hold caps: the marks that hang where each bar last topped out and sink back on their own.
• —Waveform got a mirrored body and a glow that flares on the beat, and Pulse throws a ring outwards on every kick.
• —All of it still holds still for anyone who has asked their system for less motion.

Socials sit where you put them, and a stray line under the card is gone

Three things that were quietly not doing what they said, found by going over the profile and the pages around it.

• —Socials set to “With name” landed under your bio, in the same spot as “Under bio” — two settings, one result. They now sit with your name, and all three positions are actually different.
• —A divider and a band of empty padding could appear at the bottom of the card when the metadata row was switched on but everything in it was switched off. The row now appears only when it has something to show.
• —Every visit to the homepage and the sign-up page fired a request that could only ever come back as a 404: the health check it was calling has been admin-only since the security pass, so for a visitor it fetched nothing and then drew nothing.
• —The status page did the same thing for a different reason — it linked to that health endpoint with a link that prefetches, so simply opening the page went and fetched the 404 in advance.

Four looks for the player, and no more signing in when you already are

The player had one appearance and you were stuck with it. There are four now, chosen in Appearance, and they all run off the same audio. Signing in while already signed in also stops sending you back to a form you have no use for.

• —Spectrum — the frequency bars, as before.
• —Waveform — the actual wave, drawn as it plays. It normalises itself, so a quiet track is just as readable as a loud one instead of a flat line.
• —Pulse — rings around the player that breathe with the track.
• —Minimal — no visualiser at all, just the controls.
• —Skip ten seconds back and forward, and a repeat toggle you can turn off if you would rather the track ended.
• —Whichever look you pick, the controls, the seeking, the keyboard support and the reduced-motion behaviour are identical — only the drawing changes.
• —The floating player rests as just its button again. Now that the panel behind it holds a whole player, leaving it in place while invisible had it quietly swallowing clicks across the bottom-right corner of the page.
• —Opening the sign-in or sign-up page while already signed in now takes you to your dashboard instead of showing a form that would only replace your session.
• —The dashboard already sent you to sign in when you were signed out; the two now mirror each other.

Build the card people see when they paste your link

Sharing a profile used to produce whatever could be scraped off it — your name, your bio, your avatar, and no say in any of it. There is now a builder for it in Appearance, with a preview of the real thing.

• —Set the title, the description and the small line of text above them. Leave any of them empty and it falls back to your profile the way it always did.
• —Pick the colour of the stripe Discord draws down the side of the card. Empty follows your accent colour.
• —Give it an image — upload a PNG, JPG, GIF or WebP up to 8MB, or paste a link to one. Animated GIFs stay animated.
• —Choose between a banner across the card and a small square beside the text.
• —The preview is drawn from the same code that writes the real tags, so what you see in the dashboard is what a chat client will build — fallbacks included.
• —The site's own link now shows the LARP logo when you share larp-bio.vercel.app. Profiles are untouched by it: your card stays yours.

A music player that moves with the music, and full control of your cursor

The player was a play button, a row of dots that ignored the song, and a volume slider — no way to see how far in you were, no way to skip, nothing reacting to anything. It has been rebuilt. And the custom cursor is now yours to size and aim.

• —The bars are a real spectrum. They read the actual frequencies coming out of the track, so the low end moves with the bass and the top end with the hats — it is the song you are watching, not a loop.
• —Files we are not allowed to measure fall back to a flowing animation instead, and your music never suffers for it: if reading the audio is not permitted, the player simply does not try.
• —A progress bar you can drag, click or arrow-key anywhere in the track, with the buffered part shown behind it.
• —The time you are at and the length of the track, and the name of what is playing — without the upload timestamp and storage gibberish around it.
• —A spinner while it buffers, a soft pulse on the button while it plays, and press states that answer you.
• —Everything is reachable by keyboard and announced to screen readers, and the whole visualiser holds still for anyone who has asked their system for less motion.
• —Custom cursor: a size slider from 8 to 64px, and four ways to set the click point — Auto from the artwork, top left, centre, or placed by hand.
• —The cursor panel shows your image magnified with a red dot on the exact pixel a click will land, updating as you drag. It runs the same code the live page does, so what you see is what visitors get.

Set your own card glass, and a cursor that clicks where it points

How frosted the card is was decided by the card style and nothing else. It is a slider now, on phone and desktop alike. And the custom cursor finally clicks where the drawing points.

• —Card Blur, under Appearance → Motion → Fine tuning. Slide it up for heavy frosted glass, all the way down for a flat card with no glass at all, anywhere in between for something subtler.
• —It starts on Auto, which follows whichever card style you have chosen — so nothing about your page changes until you move it, and the Auto button puts it back.
• —The live preview updates as you drag, and the setting behaves the same whether you are editing from a phone or a desktop.
• —The custom cursor now clicks exactly where it looks like it is pointing. The click point used to sit at the corner of the image, which for anything drawn on a diagonal is the empty square beside the tip — on the cursor we tested it was 12 pixels away from the drawing, on a cursor only 22 pixels wide.
• —The click point is now found from the artwork itself: the top of what is actually drawn, centred on it. It lands on the tip of a pointer, and on the leading edge of anything that has no tip.
• —Cursors are also rendered for high-resolution screens, so the point stays a point instead of a soft smudge. Browsers that cannot use the sharper copy keep the ordinary one.

Mobile pass: no more flicker, and badges you can actually read

Profiles were flickering on phones, and a fair amount of the site could only be used with a mouse. This is a pass over the whole mobile experience, checked on a real browser at every width from 320 to 1440 pixels.

• —Profiles no longer flicker on a phone. The page sat a sliver taller than the screen, so any scroll collapsed the address bar, which resized the viewport and reset the particle background mid-frame.
• —Three more things were repainting the card every single frame on touch: the box tilt, which cannot work without a mouse but still wrapped the card in a 3D layer; the animated border; and the particle field, which was doing far more drawing than it needed. A throttled phone went from roughly 48 frames a second to 59.
• —Badge names and your UID can be read on a phone. Both were only ever shown on hover, which a finger cannot do — tap a badge or your name to see them, tap anywhere else to dismiss. Tapping a social icon still opens the link.
• —The music player no longer slides out of its card. Whether it fitted depended on the layout and padding you had picked, so it looked random; the narrower combinations pushed it over the edge.
• —The volume slider was rendering four pixels tall and was close to impossible to grab. It is 28 pixels on touch now.
• —A long display name ran out of the card and the end was quietly cut off. Long names wrap instead.
• —Every control smaller than a fingertip — mute, play, social icons, the footer link — now has a full-size tap area, without anything moving on screen.
• —There is a menu on narrow screens. Discover, Leaderboard, Pricing, Badges, Docs, Status, About, Changelog, FAQ, Discord and Sign in previously had no entry point at all on a phone.
• —The dashboard menu on a phone now offers “View my page”, which until now only the desktop sidebar had.
• —Profile effects follow the system “reduce motion” setting, which the whole profile layer had been ignoring.

Pricing on the homepage, and a footer that goes everywhere

The homepage explains what LARP costs instead of only implying it, and the rest of the site is one click away from the bottom of every page.

• —The homepage shows the pricing. It reads the live member count, the progress towards the 120-member threshold and the price from the same place the pricing page does, so the two can never drift apart.
• —The footer lists the whole site — product, build, support and company — rather than three links.
• —Keyboard focus is visible again. Tabbing through a page used to give no indication of where you were, and the form fields hid it deliberately.
• —Long page headings no longer push a narrow screen sideways.
• —In-page links scroll rather than jump, unless you have asked your system for less motion.

Pricing page, multiple aliases, and a public API

Premium now has a price and a page explaining it, aliases are no longer limited to one, and the changelog you are reading is written from the admin panel instead of a code change.

• —Pricing: premium is 6.99 EUR paid once, and an extra alias is 1.99 EUR. Premium stays locked until the community reaches 120 members — until then every account already has the full feature set at no cost.
• —Aliases: an account can hold several, each one reaching the profile and working for sign-in. The first is free; further slots are granted per account.
• —Admin panel: alias slots can be handed out per user, and the changelog is edited there and published without a deploy.
• —Public API: profiles, the directory, the leaderboard and the badge catalogue are documented under /docs, with the index at /api.
• —Custom cursor: uploads larger than the size browsers accept were silently ignored and left the default cursor. They are now trimmed to the drawing and scaled to the size of a normal cursor, so the click point sits on the artwork instead of in the empty space around it, and the cursor is in place from the first frame rather than changing after the reveal screen.
• —Appearance: the Portfolio layout joins Centered, Compact, Wide and Minimal in the layout picker.

Premium tier, stronger sign-in, and a security pass

Everything on LARP is free while the community is under 120 members. Once it gets there, premium becomes a one-off purchase and the features below move behind it.

• —Premium: free for everyone until 120 members, then a single payment. The member count is measured on the server and cannot be influenced from a browser.
• —Badges: choose which of your badges are public and drag them into the order you want.
• —Badges cannot be faked — a self-made badge may not be labelled Verified, Staff or anything close to it.
• —Typewriter: several bio lines that rotate, with the typing, deleting and hold speed under your control.
• —Reveal screen: an optional click-to-enter screen in front of your page.
• —Two-factor authentication with an authenticator app and ten single-use recovery codes.
• —Passwords are checked for strength; a weak one has to be replaced before the dashboard opens.
• —Your UID is shown in the dashboard with a copy button.

Security fixes

A security pass over the whole application, verified against the running site.

• —Public profile pages published the account's password hash and email address in the page source. Only the fields a profile needs now reach the browser.
• —Links and socials accepted javascript: URLs. Only http, https and mailto are accepted now.
• —The image optimizer accepted any host, which made it a proxy into anything the server could reach.
• —Rate limiting on uploads, verification emails, sign-in and signup.

Initial user and badge system

Login, badges, admin panel, account settings, and persistent storage checks.