← All reportsPublic report

docusealco/docuseal

Open source DocuSign alternative. Create, fill, and sign digital documents ✍️

18k stars Ruby View on GitHubprofiled 11d ago
Try GitZoid
124PRs this week
2Contributors
1014Deps scanned
0Issues found
01 · Repo overview

How docuseal is put together

DocuSeal is an open-source document filling and e-signing platform built as a monolithic Ruby on Rails application (config.load_defaults 8.1) with a Vue 3 + Turbo frontend bundled via Shakapacker/Webpack. Business logic lives largely in plain-Ruby service modules under lib/ (templates, submissions, submitters, webhooks, PDF processing), while a large set of narrowly-scoped controllers under app/controllers handle routing. Data is stored by default in SQLite, with PostgreSQL or MySQL selectable via DATABASE_URL, background jobs run through Sidekiq, and files are stored on disk or S3/GCS/Azure Blob via Active Storage.

Languages

RubyJavaScriptVue SFCERBSCSS/CSS

Frameworks

Ruby on Rails 8.1Vue 3Hotwire/Turbo@github/catalystTailwindCSS + DaisyUIDeviseCanCanCanSidekiqHexaPDFShakapacker/Webpack

Datastores

SQLite (default)PostgreSQL (via DATABASE_URL)MySQL (trilogy adapter)Sidekiq-backed job queue

Infrastructure

Docker (Dockerfile, docker-compose.yml with Caddy TLS)Puma app serverProcfile / Procfile.devActive Storage disk/S3/GCS/Azure Blob

Major components

Template management

Creating, cloning, sharing, archiving, and field-detecting PDF document templates (templates_* controllers plus lib/templates.rb, lib/template_versions.rb, lib/template_folders.rb).

Submission & signing flow

Public signing forms, declines, delegation, metadata, downloads, and completion handling (submit_form_* controllers plus lib/submissions.rb, lib/submitters.rb).

PDF processing & signatures

PDF manipulation, icon rendering, signature verification, and certificate generation using HexaPDF, pdfium, and lib/pdf_utils.rb / lib/verify_pdf_signature.rb / lib/generate_certificate.rb.

Authentication & MFA

Session/password management, two-factor authentication (devise-two-factor, rotp), MFA setup, invitations, and access-token reveal (sessions, passwords, mfa_setup, invitations, reveal_access_token controllers).

API, webhooks & integrations

API settings, MCP endpoints, webhook delivery (lib/send_webhook_request.rb, lib/webhook_urls.rb), JWT issuance (lib/json_web_token.rb), and outbound HTTP via Faraday.

Storage configuration

Configurable file storage backends (disk/S3/GCS/Azure) and SMTP/SMS settings per deployment or account (storage_settings, email_smtp_settings, sms_settings controllers, lib/load_active_storage_configs.rb, config/storage.yml).

Frontend builders

Vue-based template builder and submission form UIs under app/javascript (template_builder/, submission_form/) styled with scoped Tailwind configs.

Background jobs & events

Asynchronous work and audit/event tracking via Sidekiq (config/sidekiq.yml) and lib/submission_events.rb / lib/email_messages.rb.

Over the past month, the DocuSeal team focused heavily on polishing the signing experience and fixing mobile and redirect issues, while also improving PDF processing performance. Security and reliability got steady attention, with two-factor authentication improvements, rate limiting, input sanitization, and authorization checks added across the app. Later weeks shifted toward infrastructure work like better PDF form detection and merging optimizations, plus internationalization support for new payment options.

Week by week

2026-08-24A quieter maintenance week focused on cleanup and small fixes around declining signatures.latest4 changes

Fix

Reset decline values

When a signer declines a document, previously entered values are now cleared so stale answers don't carry over.

Chore

Merged internal branch updates

Work from the team's development branch was merged into the main codebase.

Refactor

Pass fetch options cleanly

Internal code for fetching data was restructured to pass settings in a cleaner way.

Refactor

Code cleanup

General tidying of the codebase without changing how features behave.

2026-08-17A high-volume week of fixes spanning two-factor email login, resubmitting documents, translations, and PDF processing from Word files.6 changes

Feature

Process PDFs from Word documents

Documents uploaded as Word files can now be converted into signable PDFs.

Feature

Remember session on start forms

People filling out a start form can have their progress remembered between visits via their session.

Fix

Improved two-factor email flow

The two-factor authentication email form was adjusted and email addresses are normalized to prevent login issues.

Fix

Fixed completed-document emails

Emails notifying everyone when a document is fully signed were fixed after a sending bug.

Feature

Added translations and personalization tooltips

More interface languages were supported and helpful tooltips were added to guide users through personalization fields.

Fix

Mobile and RTL layout fixes

Right-to-left language layouts were corrected along with several redirect errors that broke pages on phones.

2026-08-10Performance and PDF internals took center stage, with faster document processing plus a new tool for detecting fillable form fields.6 changes

Refactor

Faster PDF handling

Merging, decrypting, and flattening PDFs all became quicker thanks to targeted optimizations.

Feature

Automatic detection of fillable PDF fields

The app can now find existing form fields inside uploaded PDFs using the Pdfium engine, making imports smarter.

Feature

Import of AcroForm fields

Standard interactive PDF form data is now imported so previously filled information isn't lost.

Fix

Fixed infinite loop bugs

Two separate issues that could cause the system to get stuck repeating work indefinitely were resolved.

Fix

Reminder permissions tightened

Users must now be authorized before configuring reminders about unsigned documents.

Fix

Email and download corrections

Duplicate email recipients were removed and downloads for view-only users were fixed.

2026-08-03Security hardening and search safety led this week, alongside database compatibility and preview improvements.6 changes

Fix

Safer search queries

Search input is now cleaned up before use, preventing malicious queries from causing problems.

Fix

Added user authorization checks

Additional permission checks ensure users can only access actions they're allowed to take.

Fix

Guarded emails and messages

Two-factor authentication emails and template save messages now have safeguards against accidental or repeated sends.

Feature

PayPal translations

PayPal-related content in the product now supports multiple languages.

Fix

MySQL migration fixes

Database setup scripts were corrected so they run properly on MySQL servers.

Fix

Preview and autocomplete fixes

Dynamic document previews render correctly again and the autocomplete field behaves as expected.

2026-07-27A big mobile usability push dominated this week, with many phone-specific fixes plus PayPal configuration and security rate limits.6 changes

Fix

Extensive mobile interface fixes

Tabs, modals, drawers, and page layouts on phones and tablets were repaired across multiple commits.

Fix

Numeric keyboard for verification codes

Entering one-time passcodes on mobile now brings up the number pad automatically instead of the full keyboard.

Feature

PayPal configurations

Settings groundwork was laid for PayPal integration support.

Fix

Rate limit for disabling 2FA

Attempts to turn off two-factor authentication are now limited to prevent abuse.

Fix

Email BCC limits enforced

Bulk email sends respect recipient limits so messages don't fail when copied addresses pile up.

Chore

Framework and library updates

The underlying web framework Rails and other dependencies were upgraded to newer versions.

03 · Security check

Dependencies and code review

1014 dependencies scanned

Dependency advisories

Security Watch

No known advisories across 1014 scanned dependencies.

No known advisories in the scanned dependencies.

Code review

warningauthzPOST /users/sign_in (app/controllers/sessions_controller.rb, after_sign_in_path_for)

POST /users/sign_in (app/controllers/sessions_controller.rb, after_sign_in_path_for)

An attacker can bounce freshly authenticated victims to an arbitrary external site immediately after login, enabling targeted phishing and credential re-harvesting against DocuSeal users.

Fix: Only permit relative destinations: return params[:redir] solely when it starts with a single slash and does not start with // (or use ActionDispatch::Routing::UrlFor / a redirect allowlist), and fall back to super for everything else.

Get this report every week for your repos.

GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.

$19 a month, flat · First 10 outputs free · No card required