docusealco/docuseal
Open source DocuSign alternative. Create, fill, and sign digital documents ✍️
How docuseal is put together
DocuSeal is an open-source document filling and e-signing platform built as a monolithic Ruby on Rails application (config.load_defaults 8.1) with a Vue 3 + Turbo frontend bundled via Shakapacker/Webpack. Business logic lives largely in plain-Ruby service modules under lib/ (templates, submissions, submitters, webhooks, PDF processing), while a large set of narrowly-scoped controllers under app/controllers handle routing. Data is stored by default in SQLite, with PostgreSQL or MySQL selectable via DATABASE_URL, background jobs run through Sidekiq, and files are stored on disk or S3/GCS/Azure Blob via Active Storage.
Languages
Frameworks
Datastores
Infrastructure
Major components
Template management
Creating, cloning, sharing, archiving, and field-detecting PDF document templates (templates_* controllers plus lib/templates.rb, lib/template_versions.rb, lib/template_folders.rb).
Submission & signing flow
Public signing forms, declines, delegation, metadata, downloads, and completion handling (submit_form_* controllers plus lib/submissions.rb, lib/submitters.rb).
PDF processing & signatures
PDF manipulation, icon rendering, signature verification, and certificate generation using HexaPDF, pdfium, and lib/pdf_utils.rb / lib/verify_pdf_signature.rb / lib/generate_certificate.rb.
Authentication & MFA
Session/password management, two-factor authentication (devise-two-factor, rotp), MFA setup, invitations, and access-token reveal (sessions, passwords, mfa_setup, invitations, reveal_access_token controllers).
API, webhooks & integrations
API settings, MCP endpoints, webhook delivery (lib/send_webhook_request.rb, lib/webhook_urls.rb), JWT issuance (lib/json_web_token.rb), and outbound HTTP via Faraday.
Storage configuration
Configurable file storage backends (disk/S3/GCS/Azure) and SMTP/SMS settings per deployment or account (storage_settings, email_smtp_settings, sms_settings controllers, lib/load_active_storage_configs.rb, config/storage.yml).
Frontend builders
Vue-based template builder and submission form UIs under app/javascript (template_builder/, submission_form/) styled with scoped Tailwind configs.
Background jobs & events
Asynchronous work and audit/event tracking via Sidekiq (config/sidekiq.yml) and lib/submission_events.rb / lib/email_messages.rb.
A quieter maintenance week focused on cleanup and small fixes around declining signatures.
5 weeksWeek of 2026-08-24
Week of 2026-08-24latest
A quieter maintenance week focused on cleanup and small fixes around declining signatures.
Week of 2026-08-17
A high-volume week of fixes spanning two-factor email login, resubmitting documents, translations, and PDF processing from Word files.
Week of 2026-08-10
Performance and PDF internals took center stage, with faster document processing plus a new tool for detecting fillable form fields.
Week of 2026-08-03
Security hardening and search safety led this week, alongside database compatibility and preview improvements.
Week of 2026-07-27
A big mobile usability push dominated this week, with many phone-specific fixes plus PayPal configuration and security rate limits.
Over the past month, the DocuSeal team focused heavily on polishing the signing experience and fixing mobile and redirect issues, while also improving PDF processing performance. Security and reliability got steady attention, with two-factor authentication improvements, rate limiting, input sanitization, and authorization checks added across the app. Later weeks shifted toward infrastructure work like better PDF form detection and merging optimizations, plus internationalization support for new payment options.
Week by week
2026-08-24A quieter maintenance week focused on cleanup and small fixes around declining signatures.latest4 changes
Fix
Reset decline values
When a signer declines a document, previously entered values are now cleared so stale answers don't carry over.
Chore
Merged internal branch updates
Work from the team's development branch was merged into the main codebase.
Refactor
Pass fetch options cleanly
Internal code for fetching data was restructured to pass settings in a cleaner way.
Refactor
Code cleanup
General tidying of the codebase without changing how features behave.
2026-08-17A high-volume week of fixes spanning two-factor email login, resubmitting documents, translations, and PDF processing from Word files.6 changes
Feature
Process PDFs from Word documents
Documents uploaded as Word files can now be converted into signable PDFs.
Feature
Remember session on start forms
People filling out a start form can have their progress remembered between visits via their session.
Fix
Improved two-factor email flow
The two-factor authentication email form was adjusted and email addresses are normalized to prevent login issues.
Fix
Fixed completed-document emails
Emails notifying everyone when a document is fully signed were fixed after a sending bug.
Feature
Added translations and personalization tooltips
More interface languages were supported and helpful tooltips were added to guide users through personalization fields.
Fix
Mobile and RTL layout fixes
Right-to-left language layouts were corrected along with several redirect errors that broke pages on phones.
2026-08-10Performance and PDF internals took center stage, with faster document processing plus a new tool for detecting fillable form fields.6 changes
Refactor
Faster PDF handling
Merging, decrypting, and flattening PDFs all became quicker thanks to targeted optimizations.
Feature
Automatic detection of fillable PDF fields
The app can now find existing form fields inside uploaded PDFs using the Pdfium engine, making imports smarter.
Feature
Import of AcroForm fields
Standard interactive PDF form data is now imported so previously filled information isn't lost.
Fix
Fixed infinite loop bugs
Two separate issues that could cause the system to get stuck repeating work indefinitely were resolved.
Fix
Reminder permissions tightened
Users must now be authorized before configuring reminders about unsigned documents.
Fix
Email and download corrections
Duplicate email recipients were removed and downloads for view-only users were fixed.
2026-08-03Security hardening and search safety led this week, alongside database compatibility and preview improvements.6 changes
Fix
Safer search queries
Search input is now cleaned up before use, preventing malicious queries from causing problems.
Fix
Added user authorization checks
Additional permission checks ensure users can only access actions they're allowed to take.
Fix
Guarded emails and messages
Two-factor authentication emails and template save messages now have safeguards against accidental or repeated sends.
Feature
PayPal translations
PayPal-related content in the product now supports multiple languages.
Fix
MySQL migration fixes
Database setup scripts were corrected so they run properly on MySQL servers.
Fix
Preview and autocomplete fixes
Dynamic document previews render correctly again and the autocomplete field behaves as expected.
2026-07-27A big mobile usability push dominated this week, with many phone-specific fixes plus PayPal configuration and security rate limits.6 changes
Fix
Extensive mobile interface fixes
Tabs, modals, drawers, and page layouts on phones and tablets were repaired across multiple commits.
Fix
Numeric keyboard for verification codes
Entering one-time passcodes on mobile now brings up the number pad automatically instead of the full keyboard.
Feature
PayPal configurations
Settings groundwork was laid for PayPal integration support.
Fix
Rate limit for disabling 2FA
Attempts to turn off two-factor authentication are now limited to prevent abuse.
Fix
Email BCC limits enforced
Bulk email sends respect recipient limits so messages don't fail when copied addresses pile up.
Chore
Framework and library updates
The underlying web framework Rails and other dependencies were upgraded to newer versions.
Dependencies and code review
Dependency advisories
Security Watch
No known advisories across 1014 scanned dependencies.
No known advisories in the scanned dependencies.
Code review
POST /users/sign_in (app/controllers/sessions_controller.rb, after_sign_in_path_for)
An attacker can bounce freshly authenticated victims to an arbitrary external site immediately after login, enabling targeted phishing and credential re-harvesting against DocuSeal users.
Fix: Only permit relative destinations: return params[:redir] solely when it starts with a single slash and does not start with // (or use ActionDispatch::Routing::UrlFor / a redirect allowlist), and fall back to super for everything else.
Get this report every week for your repos.
GitZoid learns each repo, reports what changed, and flags what needs attention. One flat price for the whole team.
$19 a month, flat · First 10 outputs free · No card required