Aha!
Aha! is hardening Builder from a PM prototyping toy into a governed internal-app platform.
Comparison · PM
Kanboard vs Shortcut
A side-by-side editorial comparison of Kanboard and Shortcut — release velocity, themes, recent moves, and the top alternatives to consider.
Shared themes:project-management
Kanboard vs Shortcut: at a glance
What is Kanboard?
Kanboard is on a year-long security-hardening run, sweeping the codebase one attack class at a time.
Kanboard's last six releases read as a single sustained security audit: parameterized queries replacing raw SQL, SSRF protection for webhooks, LDAP injection escapes, timing-safe token comparisons, CSRF for project role changes, comment-visibility enforcement for unauthenticated users, and removal of unsafe deserialization paths (file cache driver, legacy serialized events). Feature work continues in parallel — RTL support, Arabic translation, sub-task counts, bulk tag operations — but is clearly secondary to the hardening arc.
What is Shortcut?
Shortcut redesigns its API for AI agents and pushes Korey beyond its own walls.
Shortcut is making concrete bets on agent-based work. API v4 entered alpha on May 12 with explicit framing around expanded capabilities and 'agent compatibility' — a positioning shift, not just a version bump. Their in-house AI assistant Korey is expanding outward: right-click access in February, then a dedicated Chrome extension in April that runs on any webpage. Around the strategic work, smaller improvements (Teams on Roadmap, March's SLA Alerts) keep shipping, alongside feed-noise from brand-guide pages being scraped as if they were releases.
Kanboard vs Shortcut: editorial side-by-side
Kanboard
0.0PM
Kanboard is on a year-long security-hardening run, sweeping the codebase one attack class at a time.
◆ Current state
Kanboard's last six releases read as a single sustained security audit: parameterized queries replacing raw SQL, SSRF protection for webhooks, LDAP injection escapes, timing-safe token comparisons, CSRF for project role changes, comment-visibility enforcement for unauthenticated users, and removal of unsafe deserialization paths (file cache driver, legacy serialized events). Feature work continues in parallel — RTL support, Arabic translation, sub-task counts, bulk tag operations — but is clearly secondary to the hardening arc.
◆ Where it's heading
The team is methodically working through input surfaces (LDAP, headers, webhooks, file uploads, redirect targets) and output surfaces (comments, exports, API responses) to close authorization and injection gaps. This is mature-project hygiene, not pivot work — Kanboard is positioning itself as an audit-ready self-hostable kanban for organizations with security review checklists. PHP 8.1 is now the floor; the codebase is being modernized alongside the hardening.
◆ Prediction
Expect the security cadence to continue with one to two more releases focused on remaining trust boundaries, then a feature-weighted release picking up RTL/locale follow-ons and possibly the long-promised SQLite/Postgres parity work hinted at by recent Docker Compose additions.
Shortcut
7.5COLLABPM
Shortcut redesigns its API for AI agents and pushes Korey beyond its own walls.
◆ Current state
Shortcut is making concrete bets on agent-based work. API v4 entered alpha on May 12 with explicit framing around expanded capabilities and 'agent compatibility' — a positioning shift, not just a version bump. Their in-house AI assistant Korey is expanding outward: right-click access in February, then a dedicated Chrome extension in April that runs on any webpage. Around the strategic work, smaller improvements (Teams on Roadmap, March's SLA Alerts) keep shipping, alongside feed-noise from brand-guide pages being scraped as if they were releases.
◆ Where it's heading
Shortcut is positioning itself as the project-management surface that AI agents naturally operate against, not just a PM tool with AI features bolted on. Korey is being pushed from in-app helper toward general-purpose web assistant; the API is being redesigned with external agent consumers in mind. That's a coherent strategic stance the bigger PM players — Jira, Linear, Asana — have not yet made as explicitly. Underlying release cadence stays steady, suggesting these are strategic plays, not panicked pivots.
◆ Prediction
Expect API v4 to surface MCP-style tooling endpoints and structured action surfaces aimed squarely at agent frameworks. Korey's Chrome extension is likely a stepping stone toward a 'Korey anywhere' positioning — deeper integrations with browser, email, and calendar are the natural next dominoes.
Kanboard alternatives
Other PM products tracked by Sparkpulse, ranked by recent ship velocity. Tap any card for the full editorial trajectory or compare directly with Kanboard.
RescueTime
RescueTime's visible output is a productivity blog, not product releases
Unito
Unito is publishing a governance-and-architecture content library around two-way sync.
Upbase
Upbase grinds out workflow speed-ups while building toward an agency profit-tracking suite.
Asana
Asana keeps maturing AI Studio while hardening enterprise governance and cross-app integrations.
Notesnook
Notesnook ships steady point releases across desktop and Android, with hotfixes close behind
Shortcut alternatives
Other PM products tracked by Sparkpulse, ranked by recent ship velocity. Tap any card for the full editorial trajectory or compare directly with Shortcut.
Avoma
Avoma ships an MCP server to pipe its meeting data into Claude and ChatGPT, amid a wall of comparison content.
GitHub
GitHub bends its security stack toward governing the coding agents now writing the code.
BookStack
BookStack runs a disciplined security-release cadence, with occasional CalVer feature drops.
pCloud
pCloud's feed is mostly storage marketing — with one real feature in Rewind point-in-time recovery.
Asana
Asana keeps maturing AI Studio while hardening enterprise governance and cross-app integrations.
Mattermost
Mattermost doubles down on sovereign, post-quantum defence collaboration with an agentic layer on top.
Recent activity from Kanboard and Shortcut
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 29d agoShortcutAPI v4 alpha now available ⚡
- 1mo agoShortcutKorey Chrome Extension ⚡
- 1mo agoShortcutTeams on Roadmap
- 1mo agoShortcutBrand-guide page (logo) ingested by feed
- 2mo agoShortcutBrand-guide page (colors) ingested by feed
- 2mo agoShortcutRelease-notes index aggregation (no new content)
- 2mo agoKanboardKanboard 1.2.52
- 3mo agoKanboardKanboard 1.2.51
- 4mo agoKanboardKanboard 1.2.50
- 5mo agoKanboardKanboard 1.2.49
- 7mo agoKanboardKanboard 1.2.48
- 10mo agoKanboardKanboard 1.2.47
Frequently asked questions
What is the difference between Kanboard and Shortcut?
Both compete on the same themes — project-management — within PM. Shortcut is currently shipping more aggressively (velocity 7.5 vs 0.0), with 1 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Kanboard better than Shortcut?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Shortcut is currently shipping more aggressively (velocity 7.5 vs 0.0), with 1 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other PM products to evaluate alongside.
What are the best alternatives to Kanboard?
Top Kanboard alternatives in PM are ranked by recent ship velocity. Browse the "Kanboard alternatives" section above for the current picks, or visit /alternatives/kanboard for the full list with editorial commentary on each.
What are the best alternatives to Shortcut?
Top Shortcut alternatives in PM are ranked by recent ship velocity. Browse the "Shortcut alternatives" section above for the current picks, or visit /alternatives/shortcut for the full list with editorial commentary on each.