Monitoring & Observability
- Health check endpoint at /health/ — reports DB, Redis, Celery workers, Celery Beat and disk usage (#132)
- Prometheus metrics at /metrics/ with Grafana dashboard — request rate, latency, error rate, DB query duration, cache hit ratio (#134)
- Sentry error tracking — unhandled exceptions captured with full context from Django and Celery (#133)
- Structured JSON request logging — every request logged with real client IP, user, path, status and duration; daily log rotation with 30-day retention (#202, #224)
- fail2ban filters and Cloudflare ban action for access log — repeated 404s and scanner probes trigger an IP ban at Cloudflare edge

Security
- Account lockout — 5 failed login attempts lock the IP+username combination for 10 minutes with a clear message (#277)
- HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy and secure cookie flags configured in Django SecurityMiddleware (#258)
- Cloudflare cache rules — static assets cached aggressively, authenticated sessions and admin always bypassed (#257)
- Email DNS hardening — SPF, DKIM (RSA 2048) and DMARC (monitoring mode) configured for shooterdiary.com (#259)
- Redis as Django cache backend — separate keyspace from Celery broker (#136)

Bug Fixes
- Fixed broken manage notification preferences and manage reminders links in all notification emails (#266)
- Served favicon.ico and robots.txt — eliminated 404 log noise (#200, #203)

Notifications
- In-app notification centre with unread badge in the navbar (#104)
- Low ammo alert triggered automatically after each shooting session (#105)
- Maintenance due alert based on round count or elapsed time since last service (#106)
- Validity expiring reminders — notified 30, 14 and 7 days before a licence or document expires (#107)
- Email notifications for low ammo and maintenance due alerts (#108)
- Notification preferences — enable or disable each notification type and delivery channel (in-app / email) independently (#218)
- Reminders tab in Preferences — manage expiry dates for licences, permits and other documents (#107)

Infrastructure
- Celery + Redis async task queue — email sending and scheduled checks run in the background (#131)

UI & UX
- Unified tab navigation pattern across Firearms, Ammo, Shooting and Statistics sections (#261)

Bug Fixes
- Fixed misleading error when registering with an already-used email address (#222)
- Fixed real client IP detection behind Cloudflare — rate limiting and login tracking now use the visitor IP, not the proxy IP (#253)
- Fixed flaky session expiry test caused by incorrect environment variable name (#212)

Auth
- Login history is now properly recorded — signals were not loaded on app startup (#128)
- Automatic session expiry after 14 days of inactivity (sliding window, configurable via SESSION_TIMEOUT_DAYS) (#206)

Ammo
- Repeat purchase: ↻ button pre-fills the form with a previous order and today's date (#101)
- Notes field added to ammo purchases

Pricing
- FREE vs PRO comparison table added to the landing page and upgrade page (#127)
- PRO price shown as future price (struck through) with "Free now" badge during development phase
- Upgrade page refactored: single info box with trial activation and dev notice

Account management
- Account deactivation with 30-day grace period — account disabled immediately, data deleted after 30 days unless reactivated via email link (#129)
- Permanent delete — requires typing DELETE to confirm, immediately removes all data
- Danger zone section at the bottom of the profile page
- Both actions disabled for the demo account

Note
- ShooterDiary is still in active development. All PRO features are free during this phase.
- Paid plans are not yet active. Any changes will be communicated well in advance.