Vikunja vs Hostaway
Side-by-side trajectory, velocity, and editorial themes.
Vikunja crossed the v1.0 finish line and pivoted hard into security hardening.
Vikunja shipped two v1.0 release candidates through late 2025 and early 2026, then jumped to a v2 series whose first widely-tagged point release, v2.2.1, is dominated by security work. The latest release patches multiple SSRF and IDOR vulnerabilities, enforces disabled/locked-account semantics across every auth surface (OIDC, API tokens, CalDAV, LDAP), and adds a shared SSRF-safe HTTP client that webhooks and migrations now route through. User-facing feature work has slowed; the visible energy is in plumbing and audit cleanup.
The arc moves from feature-completion (S3 storage, drag-and-drop project moves, hover previews in late 2025) toward platform credibility — closing security gaps a self-hosted task tool needs to clear before serious team adoption. The rapid version-number jump from v1.0.0-rc4 to v2.2.1 in two months suggests v1.0 shipped and the team tagged a v2 line aimed at addressing accumulated authz debt. Expect the next several releases to keep the security-first posture rather than return to a feature push.
The next release will likely continue closing remaining authz edges (more IDOR audits, additional credential-stripping in API responses) and bundle a translations and dependency sweep. A user-facing feature push probably waits until the security work plateaus.
Hostaway pushes AI into the host inbox and starts pulling Booking.com management onto its own platform.
Hostaway is shipping at high cadence across three threads: AI-driven inbox triage (sentiment scoring, automatic escalations) on both web and mobile, finance and reporting depth (multi-unit reporting, owner-statement email delivery), and channel control (Booking.com Content Sync Phase 1, Booking Website Pro for direct bookings). The mobile app is closing parity gaps quickly, with custom field editing and bulk pricing now on-device.
The recent pattern points to Hostaway positioning as the operations hub property managers run their entire portfolio from — including direct bookings — rather than just a property management system feeding the OTA channels. AI Sentiment and Escalations is the most directional move; it changes how hosts triage messages and is built to compound into a fuller assistant surface. The Booking.com sync is a structural play to reduce dependence on the OTA's own admin.
Phase 2 of Booking.com sync (rates, availability, deeper extranet parity) is the obvious next ship. Expect the AI inbox surface to gain auto-reply suggestions and automated guest-issue resolution flows on top of the existing sentiment scoring. Direct booking will continue to be invested in given the new Booking Website Pro line.
See more alternatives to Vikunja →
See more alternatives to Hostaway →