Changelog

Every release, logged.

Signed commit hashes, migration notes, and feature announcements. Subscribe to the RSS feed to get them in your mail.

RSS feed JSON feed Embed on your site →

v3.4.0 Latest 2026-11-05 · commit 7aeff7b

Hardware key support & shared aliases

added

WebAuthn & FIDO2 hardware-key sign-in on every account.
Shared aliases on Team plans — one address, many inboxes.
Live status page backed by the Cloudflare Worker; /api/status is public.
curl /install | sh drops a latinamail CLI into ~/.local/bin.
Single-file self-host relay at /selfhost — loopback-only, locked to one owner.

changed

Dashboard split into tab-routed panels: Overview, Aliases, Domains, API keys, Webhooks, Billing, Security, Settings.
Monero-only billing. Every invoice is a fresh XMR subaddress; no auto-charges.
Edge sealed behind Cloudflare Tunnel — no origin IP is public.

security

Account state defaults to receive_only until a Discord-bot verification unlocks sending.
Internal endpoints (/api/accounts/unlock, POST /api/status) require x-lm-internal shared secret.

v3.3.0 2026-10-18 · commit 4c9d12a

Alias rotation & scheduled send

added

One-click alias rotate from the dashboard. Old alias disables, new one forwards to the same inbox.
send_at on POST /v1/messages — defer delivery to an RFC3339 timestamp.
Snooze threads from the mail app; return on your schedule.
Typed SDK for Rust (cargo add latinamail).

fixed

Inbound webhook signatures weren’t canonicalising header order consistently. All signers now match the Edge Worker.
IMAP bridge dropped idle connections after 9 minutes instead of 29. Session timeout aligned with RFC 9051.

v3.2.0 2026-09-24 · commit 1f7a830

Field-level encrypted database

added

Every user-facing column (from, to, subject, body, aliases, domains) is now AES-256-GCM encrypted at rest with a per-row IV.
Attachments live in R2, separate bucket, encrypted blobs addressed by account/msg/name.
Without the key, every row decrypts to the marker "made by latinamail" — confirmed in the leak-demo on the homepage.

changed

Migrated primary database from Postgres to Cloudflare D1. Column shape unchanged — see db/schema.sql.
Key rotation now supports a dual-key window (LM_ENCRYPTION_KEY + LM_ENCRYPTION_KEY_OLD).

v3.1.0 2026-08-09 · commit 9b2e4f1

Tunnel & Turnstile

security

Origin moved behind Cloudflare Tunnel. Direct IP scanning on the mail server gets nothing.
Cloudflare Turnstile required on every state-changing request (signup, signin, send, alias.create).
Rate limits: 60 req/min/IP, 5 signups/hour/ASN, exponential backoff on repeated failures.
HMAC-signed session cookies bound to browser fingerprint.

added

Developer dashboard with scoped API tokens (read, write, admin).
Inbound webhooks with signed delivery and retry schedule (1m, 5m, 1h, 6h, 24h).

v3.0.0 Rebrand 2026-06-20 · commit 0ac51d8

LatinaMail

changed

Final rebrand to LatinaMail. Same code, same keys, final name.
Added domain pool: @latinamail.com, @lat.mx, @privada.lat and more. Swap anytime.
Site rebuilt as a static Cloudflare Pages project with per-route Workers.

removed

Previous brand names retired. Historical aliases still forward.
Credit-card payment deprecated. Monero only going forward.

Unreleased Roadmap

What’s cooking

Breach-watch ($35/mo) goes into public beta.
Free Pro for verified .edu and corporate domains with accredited-registry cross-check.
Gmail / Outlook one-click import.
Tor-backed free breach scan (weekly cadence).
Custom domains available to all paid tiers.
Native desktop client (Linux, macOS, Windows) once the backend audits pass.

Embed & RSS

Put the changelog on your own site.

Three ways to syndicate: raw RSS, JSON Feed, or an iframe-friendly widget themed to match your UI. Pick one, paste it in, done.

RSS 2.0

Point a reader at it

Any feed reader — NetNewsWire, Feedly, Thunderbird, FreshRSS — subscribes directly.

https://latinamail.pages.dev/rss.xml

Also expose it in your <head>:

<link rel="alternate"
      type="application/rss+xml"
      title="LatinaMail changelog"
      href="https://latinamail.pages.dev/rss.xml">

JSON Feed 1.1

Fetch and render yourself

CORS-enabled, cache-friendly. Read it from a Worker or any browser.

const feed = await fetch(
  'https://latinamail.pages.dev/feed.json'
).then(r => r.json());

feed.items.forEach(it => console.log(it.title, it.url));

iframethemed

Drop-in widget

Prebuilt card list, light & dark aware, no dependencies.

<iframe src="https://latinamail.pages.dev/embed/changelog?limit=5"
        width="100%" height="480" loading="lazy"
        style="border:0;border-radius:12px"
        title="LatinaMail changelog"></iframe>

Query params: limit (1–20), theme=light|dark.

Live preview

/embed/changelog?limit=5