v0.4.0 — security hardening

Security release

This release hardens how postctl stores credentials and publishes posts, based on an internal security review. No exploitation is known. An advisory with details follows (see the repository's Security tab). Please update.

What changed

• Owner-only files: config, database and logs are written 0600 (directories 0700); older files are tightened on start.
• Token key per installation: tokens are encrypted with a random key file (~/.config/postctl/encryption.key). Existing installs switch with postctl security migrate; postctl security status shows the state.
• Backups: PBKDF2-HMAC-SHA256 (600k iterations, random salt). Old backups still restore.
• Uploads: only real PNG/JPEG/GIF/WebP files (≤ 25 MB) are uploaded from local paths.
• Secrets in logs: token-like values are redacted from logs, history and errors; postctl config set KEY - reads a secret from stdin.
• OAuth: random state; forged callbacks no longer abort a login.
• MCP: publishing/scheduling is off unless POSTCTL_MCP_ALLOW_PUBLISH=1.
• X cookie mode (unofficial) is off by default: twitter.unofficial_cookie_mode: true to opt in. Debug screenshot removed, Chrome sandbox on.
• Also: license-check timeout, safer git hook.

Upgrade notes

If your database is shared between several machines, install this version everywhere and copy encryption.key to each machine before running postctl security migrate. If other people use your machine, or you imported Markdown from untrusted sources, rotate your API tokens.

Full list: README.md → Security, and SECURITY.md.