Publishing a post or page on a brand running on brand-sites now reaches the live site within seconds. A burst of edits to one brand collapses into a single revalidation request, removed and renamed pages are named in it so the old address stops being served, and every request is logged with its outcome. IndexNow (Bing, Yandex) gets the same ping, using the brand's live address, and only once the site is actually public.
Each brand built as its own codebase now gets its own <brand>.pendium.io address, private until the owner makes it public. "View site" and post and page previews open that address with drafts included. A signed-out visitor to a private address lands on Pendium's login and returns to the right page after signing in. For brands with no custom domain, making the site public makes that address the live, indexable one. A connected custom domain stays live regardless of the public toggle, and saving a domain no longer flips the site public.
Old pendium.ai/{username} URLs for a brand on brand-sites now permanently redirect to the same path on the brand's current address — its own domain, a folder on that domain, or its pendium.io address — query strings included. While the site is private, or for a brand with no site, those URLs return a plain not-found page.
Admins have two new tools. The Brand sites page (Admin → Brand sites) shows who renders each brand's site, whether it's live, the routing entry brand-sites serves from, when it last fetched the site export, and every revalidation ping Pendium sent with its outcome. A "Revalidate now" button purges the export cache and reports whether the ping was queued. Admin → Site builds has a "Start a build" form for moving an existing customer onto brand-sites by brand ID, and a "Preview draft" link on any deployed build. Live progress — current phase, last check-in, links to the GitHub run and its preview — updates without a reload. A run that goes quiet for 15 minutes reads Stalled, and the team gets a Slack alert.
The site export (GET /api/v1/site/export) now gives every page and post the exact path Pendium serves it at, so a site rendered outside Pendium can preserve every URL when a domain moves. It also includes categories, authors, listing pages, each post's hero image and category slugs, whether posts are switched on, what the root renders, and a canonicalOrigin field for building canonical URLs. A new previews field carries the site preview images Pendium drew, and a new set of previews changes the export's ETag. Design data — colors, fonts, logo, style, site screenshot — is no longer part of the export; a site built outside Pendium is designed in its own build.
The visual identity page now shows only what Pendium uses for its own output: brand colors, style, logo details, and the images Pendium draws for reports and the brand profile. Font cards, component patterns and the "Gather evidence" section are gone. The onboarding visual scan no longer does site-design work for brands Pendium doesn't render — it skips the hero image, the profile refresh and component pattern extraction for those brands, while colors, typography, logo fields and the screenshot still run for every brand.
A number of security and access checks were tightened across the platform. Connecting Google Search Console, Google Docs, Instagram, X, Webflow or WordPress.com now starts server-side: the connect link is signed, expires after 15 minutes, and is tied to the signed-in user and browser. Every connection callback verifies that link, the signed-in user, their access to the brand, and read-only status before contacting the provider or saving anything. Server actions for posts, outlines, content library, training and workflows now confirm the signed-in user can access the brand those rows belong to, and read-only accounts can't change anything through them. Every admin server action checks from the session that the caller is a platform admin before doing anything, and a new build check keeps client-supplied identity out of server actions going forward.
Subpath hosting no longer forwards your visitors' cookies or Authorization headers to Pendium. The generated Cloudflare Worker drops Cookie, Authorization, Proxy-Authorization and Cf-Access-* before forwarding, fetches with redirect: "manual" so Pendium's redirects return to the browser, and removes Set-Cookie from proxied responses. For every platform, Pendium also strips those headers from each /_proxy/* request before any handler reads them. Subpath hosting setup now instructs you to list your sitemap in your domain's root robots.txt, since crawlers don't read a robots.txt below the root, with the exact Sitemap: line filled in and a Copy button.
Connecting Google Docs with a different Google account than the one linked to Search Console now marks Search Console as disconnected and clears its property, so you're asked to reconnect rather than seeing a property that has quietly stopped syncing. Connecting with the same account leaves Search Console untouched. A visibility scan now requires the full 50k credits before it starts — the previous threshold let a scan begin on the free daily allowance and run until it hit zero. A scan refused for credits on the Topics, Personas or Explore pages now opens the upgrade dialog with the reason instead of silently doing nothing.