Changelog

Security updates

0.3.1 updates the libraries Postwright is built on, after a full security scan of 0.3.0, and tightens what Postwright answers to from outside your Mac. Most of it changes nothing about how you use Postwright; the few things you might notice are called out below.

Improved

• Updated the web server, its router, and static file serving to their latest patched releases, with stricter handling of unusual request paths.
• Updated the dashboard's page router.
• Updated image processing (used for hero images and social art) to the latest patched release. Output is unchanged.
• Updated the YAML parsers that read your notes' front matter, so oversized or malformed front matter is rejected instead of slowing Postwright down.
• The installer is about 4 MB smaller: an unused fallback image library is no longer bundled.

Hardening

• **Allowed hostnames.** Postwright now only answers to its local addresses (localhost, 127.0.0.1, and `.localhost` / `.internal` names), the address it listens on, the hosts of its server and public media URLs, and hostnames you add under **Settings → Allowed hostnames**. Anything else gets a short "this address isn't allowed" page. If you reach Postwright through a reverse proxy or tunnel with its own hostname, add that name there.
• **Requests from other websites are refused.** Actions in your dashboard can't be triggered by another website or another local port. Signup, webhook, and public media routes are unaffected.
• **Per-route rate limits.** Busy or abusive traffic on one kind of route no longer blocks others. Signed media links, email-service webhooks, unsubscribe and confirm links, and signups each have their own limits.
• **Locked-down AI runs.** When Postwright uses Claude Code, it runs with no tools, no plugins, and no slash commands, in an empty folder. This needs a recent Claude Code; if yours is too old, System check and Settings tell you to run `claude update`.
• **Hero images.** Hero images named in your notes are only read from Postwright's hero folder or your vault's `Uploads/Hero Images` folder, and are published at their public web address. A local file path is never written into a published post or sent to Instagram or Threads.
• **Webhooks.** Email-service webhooks are verified against the exact bytes received, rejected if older than 5 minutes, and processed only once. Link-click webhooks are verified the same way.
• **Subscriber API key.** Repeated wrong keys are rate-limited (a correct key always works), and System check warns if your key is shorter than 32 characters.

Fixed

• The one-click newsletter approve link sent to Telegram now works without a dashboard login. It shows what's about to go out, approves only when you press Approve, works once, and expires after 24 hours.
• A newsletter can no longer be sent twice when it's approved from Telegram, the Approvals page, and the link at the same time. A cancel that arrives after sending has started now says so instead of reporting "cancelled".
• If Postwright stops partway through sending a newsletter, it marks the send as interrupted at the next start and tells you to check your email provider before resending.
• Unknown dashboard addresses now show a "page not found" page instead of a blank screen.
• The YouTube connection step only opens a genuine Google sign-in page.
• The legacy `/api/resend-confirmation` address now works for signup sites without a dashboard login, like `/api/subscribers/resend-confirmation`.
• A request with a malformed JSON body now gets a clear 400 error instead of a 500.
• Very long or unusually formatted request paths are refused the same way as any other unknown address.

Note for signup-widget users

The embeddable signup widget is served more strictly: link it with its exact file name (for example `/widget/postwright-signup.js`). Paths with different capitalization or doubled slashes are now refused.

Phone shorts, and a setup you can finish

Record a video on your phone and Postwright turns it into a captioned Short, Reel, and LinkedIn post, free in Studio. This release also replaces the first-run setup, so a fresh install goes from download to a working dashboard in one guided pass.

New

• Phone shorts (Studio): save a phone video to a folder that syncs to your Mac, such as Google Drive, Dropbox, or iCloud. Postwright transcribes it, burns in captions, and drafts YouTube, Instagram, and LinkedIn copy in your brand's voice. Edit the copy in Video Review, approve it, and it posts as a YouTube Short, an Instagram Reel, and a LinkedIn video at the next open slot.
• Approve from Telegram (optional): each phone short arrives with a preview, the copy, and Approve and Reject buttons. The app and Telegram stay in step.
• Local or cloud transcription: mlx-whisper or whisper.cpp on your Mac, or OpenAI if you'd rather skip the local models. With OpenAI, the audio is uploaded to OpenAI. Rendering still needs ffmpeg, and System check gives the command to install it.
• Install local transcription from the app: System check and Settings > Phone shorts have an Install button that sets up ffmpeg and a speech-to-text engine with Homebrew and shows its progress. The Terminal command is still there if you'd rather run it yourself.
• Bring your own AI: an Anthropic, OpenAI, or Google key, or your Claude Code subscription. Pick the provider and model for each task in Settings > AI, and set a daily spend cap.
• Guided first-run setup: content folder, your brand and audience, AI, where posts go, a phone-shorts inbox, and a system check.
• System check: lists what your Mac has and lacks (ffmpeg with captions, speech-to-text, the posting browser, disk space, folder access) with the fix beside each item. Also in Settings > System check, with a summary on the dashboard.
• In-app sign-in for YouTube, using your own Google Cloud OAuth client, and for LinkedIn, in a browser window you sign in to yourself.
• Settings > Brand: name, creator, website, audience, voice notes, and mailing address, with a checklist of what the brand still needs.
• Optional public media URL for Instagram Reels, for videos Meta rejects as uploads. Off by default.

Improved

• Drafted titles, captions, and posts now come from prompts built into Postwright and written in your brand's voice. The copy restates only what you said.
• Captions use a bundled font (Montserrat ExtraBold, SIL Open Font License), so they look the same on every Mac.
• The Studio dashboard shows phone shorts awaiting review, shorts this week, long videos in progress, and recent posts. Pro features show a locked state instead of an error.
• LinkedIn posting and metrics work with LinkedIn's September redesign, and pop-ups are dismissed before the composer opens.
• Threads posts are fitted to the 500-character limit.
• The browser Postwright posts with reports the same status in Settings, System check, and LinkedIn sign-in, and Re-check retries a failed download.
• The dashboard's font ships with the app, so opening Postwright makes no request to Google Fonts.
• The installer is about 190 MB smaller.
• New Shorts fill open slots in the schedule instead of queuing after the last one.
• Blog posts (Pro) use one type, blog_post. Files written as newsletter_blog keep working.

Fixed

• A new install couldn't create its admin password, because the setup code never reached the browser.
• A fresh install could restart in a loop after setup.
• Keys saved in Connections weren't used by the publishers.
• Clips cut from a transcript with a one-hour start timecode, as DaVinci Resolve exports, started up to 3.4 seconds early.
• Content for brands you create yourself wasn't recognized when it synced.

The first packaged release

Postwright now ships as a signed, notarized macOS installer — download, double-click, and the dashboard opens ready for setup. No Node, no git, no terminal required.

• **One-click install** — per-user installer for Apple silicon (M1 or later, macOS 14+); no admin password needed. Upgrades preserve your data, settings, and platform logins.
• **License activation** — paste your key during setup (or Settings → License). Studio keys unlock the video engine; Pro keys unlock the full content operating system. Licenses are perpetual.
• **Built-in updates** — the app checks for new releases daily and shows a download banner when one ships. No auto-install; you stay in control.
• **Self-healing service** — Postwright runs as a background service with a health watchdog; it survives reboots and recovers from crashes on its own.
• **Browser automation, hands-free** — the one-time Chromium download happens automatically on first run.

Studio is free with a Step Zero newsletter subscription. Pro is a one-time $199 upgrade — blog pipeline, newsletter and sequences, editorial AI, and SEO on top of the video engine.