Pengon is in open beta. Anyone can start a 21-day free trial, no
card, today. Here’s what we’re building right now,
what’s next, and what we’re exploring. Last updated 4 October 2026.
Building now
In progress
Classifier tuning on real customer feedback
Every Recover and Report click becomes a test case. We use them to tune the classifier's instructions and thresholds against the spam Pengon customers actually see.
In progress
Internal domain reputation signal
Auto-curates a high-spam-domain list from the AI's own verdicts, so repeat offenders get caught faster.
Next
○
Email alerts when spam patterns spike
○
Agency multi-site: add and manage multiple Squarespace sites under one account, with volume pricing
Exploring
◦
IP reputation network — cross-site protection from repeat offenders
◦
Real-time dashboard updates (no more polling)
◦
API access for power users
◦
EmDash plugin: Pengon spam checks for comments on Cloudflare's new CMS
◦
Customer analytics dashboard
29 shippedlive in production today
→
✓
AI-powered spam classification (Jev by TypeSafe, via Cloudflare AI Gateway)
✓
Honeypot bot trap (auto-injected, invisible to real visitors)
✓
Disposable email blocklist
✓
Promotional email pattern detection
✓
Page-load token — proof the form was rendered in a real browser before submission
✓
Bidirectional learning — Recover false positives, Report missed spam, both feed the training corpus
✓
Submission timing layer — reject sub-2-second form submits as bot signal
✓
Stripe billing live — monthly, annual, and lifetime founding-member plans
✓
One-click account deletion (GDPR Article 17 right-to-erasure) with full data wipe across Pengon, Stripe and Clerk
✓
Production-grade security for the 1,000-customer launch — multi-layer rate limiting, persistent IP blocklist, origin verification, automated abuse protection
✓
Authenticated dashboard with per-user data isolation
✓
Squarespace integration via lightweight script
✓
One-click setup — domain is auto-detected from your first form submission, no typing required at signup
✓
Live status pill — Active / Waiting / Inactive based on actual recent traffic, with a warning if your snippet stops reaching us
✓
Production infrastructure on Cloudflare's edge
✓
Per-row submission management (delete individual or in bulk)
✓
Anonymised training corpus — every Recover and Report click teaches the AI
✓
Landing site rebuilt on Astro — componentised, faster builds, easier to extend
✓
Dashboard rebuilt on Vite + React — TanStack Query, react-router, ready for Stripe billing and per-site settings
✓
Allowlist-first disposable check — bypass FPs on legitimate-but-obscure mail providers (amieiro list)
✓
Data export (CSV download of all your submissions)
✓
Adjustable spam sensitivity per site (Lenient / Balanced / Strict)
✓
Protection alerts — an email if your snippet ever goes offline, plus a one-time note on your first blocked spam
✓
Open self-service signup: start a 21-day free trial, no card, any time, no invitation needed
✓
Weekly spam digest emails
✓
Moved spam classification from Mistral Small 3.1 24B to Jev: about 4× faster, and it returns a calibrated spam probability instead of generated text
✓
Automatic AI backup: if Jev ever goes down, Cloudflare's own Clef model takes over, so every message still gets checked
✓
Visitor copies: real visitors can get an email copy of everything they sent through your form (spam never does)
This roadmap reflects current priorities and may change based on
customer feedback. Items in “Exploring” are directions
we’re considering, not commitments. Got something you’d
like Pengon to do? Tell us.
Under the hood, Pengon runs on Cloudflare’s edge -
Workers,
D1,
AI Gateway
and
Pages. Form classification uses
Jev
by TypeSafe, a model that returns a calibrated spam probability rather
than generated text. The marketing site is built with
Astro;
the dashboard with
Vite +
React.
Cloudflare’s
Email Service
sends transactional email;
Clerk
handles authentication.