LoginSign Up
← Back to all sparks
B

Buttondown

MKT AUTO
Velocity5.0

Email newsletter platform for writers and creators with automations, analytics, and subscriber management

buttondown.com ↗

Buttondown closes an API send loophole and blocks confirmation-email floods in its daily fixes.

newslettersaccount securityapi permissionsaccessibilitydaily releases
◆Current state
Buttondown is a newsletter platform run on a daily-changelog cadence of small fixes. Over the last week it added sign-in limits, two-factor lockouts and auto-disabled failing webhooks, then closed a gap where API keys without sending access could still send through POST /v1/emails. It also stopped bots from signing one inbox up to many newsletters at once, and raised text contrast in light and dark mode.
◆Where it's heading
The daily polish is running on two tracks: account and API security (rate limits, 2FA lockout, API key permissions, abuse protection) and accessibility (screen-reader support, keyboard navigation, now contrast). Both point at a product being hardened for larger and more compliance-sensitive senders, not at new features.
◆Prediction
Expect more permission and abuse fixes alongside further accessibility passes, still shipped as daily batches of small fixes.

◆Recent moves

  1. 2d ago

    Higher-contrast text, badges and links in light and dark mode

    Gray captions, status badges, buttons and links get higher contrast in both light and dark mode. It continues the accessibility pass that began with screen-reader support and keyboard navigation earlier in the month.

  2. 3d ago

    Blocks bots flooding an inbox with confirmation emails

    Buttondown now blocks bots that flood one inbox with confirmation emails by subscribing it to many newsletters at once. It extends the week's abuse and security work from sign-in limits to the signup flow.

  3. 4d ago

    API keys without send access can no longer send via POST /v1/emails

    API keys without sending access could still send by creating an email through POST /v1/emails; that now returns a 403, as updating and publishing already did. Drafts are unaffected. It is a permissions fix that matters to teams handing out scoped keys.

  4. 5d ago

    Sign-in rate limits, 2FA lockout, auto-disabled failing webhooks

    Webhooks now switch off after five consecutive timeouts, sign-in attempts are rate-limited, and two-factor locks for an hour after repeated wrong codes, with email alerts for each. It brings account-security hardening into the daily cadence.

  5. 6d ago

    Keyboard navigation for lists; LGPD clauses added to DPA

    Subscriber and email lists, file rows and analytics sorting now work with only a keyboard, and the DPA adds Brazil's LGPD contractual clauses. It follows last week's screen-reader work.

  6. 7d ago

    Fixes link colors, DNS checks and editor typing lag

    A batch of fixes: link colors in sent emails, stale DNS checks, editor typing lag, flaky image uploads and clearer Stripe trial errors. It's the usual daily repair work.