Product Launch
July 12, 2026 / 7 min read
Launching Cutout Studio as a Verified Beta
Cutout Studio started as a useful image tool and ended up needing a much stricter product posture before it could be treated like a real public beta. Background removal sounds simple until you think seriously about anonymous abuse, unsafe images, account state, and what you are actually willing to operate in public.
Launch note
The public beta flow now requires verified GitHub login for processing, durable policy state, moderation before cutout, abuse reporting, admin review actions, and no raw image retention by default.
Why the simple version was not enough
The first version of the app could already remove a background, but that is the easy part. The harder question is whether you are willing to expose that workflow to the public without knowing who is using it, what kinds of images they are sending, and what you will do when the wrong kind of usage appears.
A free tool with no identity, no moderation, weak logging, and no durable account state is easy to operate right up until the moment it is not. That is why the launch plan shifted from anonymous utility to accountable beta.
What changed before launch
- Verified GitHub sign-in with a real verified email requirement.
- Postgres-backed users, sessions, policy acceptance, and audit events.
- Moderation before background removal, not after it.
- Strict fail-closed behavior on moderation uncertainty.
- Signed-in abuse reporting and admin-only review actions.
- No raw image retention by default, only metadata and decision logs.
That set of changes matters because it turns the product from a demo into something closer to an operational service. The actual image processing stays useful, but the trust boundary is much more explicit.
The safety posture
The current flow is intentionally ordered. A user signs in, their account state is checked, the current policy version must be accepted, Turnstile can run when configured, moderation reviews the upload, and only then does the cutout pipeline execute.
The service also treats uncertainty as a real condition, not an excuse to carry on. Missing auth, blocked accounts, stale policy state, moderation failure, or a review-required result all stop the request rather than letting the product quietly hope for the best.
What stays private by default
The default posture is intentionally narrow. Cutout Studio does not persist raw uploads or output PNGs as part of the normal flow. Images are processed in memory, and the durable record keeps only request IDs, decision codes, hashed request metadata, timestamps, and related operator review state.
That is not just a privacy preference. It is also a product constraint: if you do not need the image later, you should be very skeptical about storing it at all.
Where the product is now
The beta app shell is now live on Sites with the safety posture visible to users. Processing remains fail-closed until the production GitHub OAuth, Postgres, moderation, and Turnstile settings are configured, which is the right default for a tool that should not process anonymous or unsafe uploads.