v0.4.1

Changelog

• 3b88514 feat(doctor): Instagram token age check (expires after 60 days; the daemon refreshes from day 30)
• 8812e81 fix(scheduler): a token this process cannot decrypt leaves the post scheduled instead of failed (old binary/TUI after key migration)
• ca97e22 fix: --dry-run no longer deletes, cancels or schedules (delete/cancel/schedule ignored the flag); regression test
• 6ab2688 release: goreleaser config + release workflow for postctl (macOS + Linux); postctl --version
• d6a73b6 tui: the default profile reads 'Privat' / 'Private' in the profile picker and the confirm dialog

v0.4.0 — security hardening

Security release

This release hardens how postctl stores credentials and publishes posts, based on an internal security review. No exploitation is known. An advisory with details follows (see the repository's Security tab). Please update.

What changed

• Owner-only files: config, database and logs are written 0600 (directories 0700); older files are tightened on start.
• Token key per installation: tokens are encrypted with a random key file (~/.config/postctl/encryption.key). Existing installs switch with postctl security migrate; postctl security status shows the state.
• Backups: PBKDF2-HMAC-SHA256 (600k iterations, random salt). Old backups still restore.
• Uploads: only real PNG/JPEG/GIF/WebP files (≤ 25 MB) are uploaded from local paths.
• Secrets in logs: token-like values are redacted from logs, history and errors; postctl config set KEY - reads a secret from stdin.
• OAuth: random state; forged callbacks no longer abort a login.
• MCP: publishing/scheduling is off unless POSTCTL_MCP_ALLOW_PUBLISH=1.
• X cookie mode (unofficial) is off by default: twitter.unofficial_cookie_mode: true to opt in. Debug screenshot removed, Chrome sandbox on.
• Also: license-check timeout, safer git hook.

Upgrade notes

If your database is shared between several machines, install this version everywhere and copy encryption.key to each machine before running postctl security migrate. If other people use your machine, or you imported Markdown from untrusted sources, rotate your API tokens.

Full list: README.md → Security, and SECURITY.md.