Ship staging to production

[postiz-contribution]

In this batch

No merged PRs in this batch yet.

Before you merge

• New environment variables (92): AGENT_API_KEY, AGENT_MEDIA_SSO_KEY, APPLE_APP_BUNDLE_ID, BACKEND_URL, CHATBASE_TOKEN, DATAFAST_API_KEY, DATAFAST_WEBSITE_ID, DISABLE_IMAGE_COMPRESSION, DISABLE_REGISTRATION, DISABLE_SSRF_PROTECTION, DISABLE_X_ANALYTICS, DISALLOW_PLUS and 80 more. Set them on production before merging.
• Environment variables no longer referenced (3): APPLE_BUNDLE_ID, APPLE_SERVICE_ID, EMAIL_FROM_ADDRESS.
• Dependencies (2): package.json, pnpm-lock.yaml
• Infrastructure and deploy config (1): docker-compose.dev.yaml

[postiz-agent]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[strix-security]

Strix Security Review

6 open security findings on this PR:

• 🟢 LOW User-linked orchestrator email logs exported to Sentry via forced console routing — apps/orchestrator/src/main.ts:46
• 🟢 LOW Frontend console logs exported to Sentry via enabled console log capture — libraries/react-shared-libraries/src/sentry/initialize.sentry.next.basic.ts:51-54
• 🟢 LOW PII disclosure to Sentry through forced NestJS console logging — apps/backend/src/main.ts:25
• 🟢 LOW Incomplete PII redaction allows user_id, org_id, and request_path to be sent to Sentry — libraries/helpers/src/utils/redact.log.attributes.ts:1-2
• 🟢 LOW Frontend console logs exported to Sentry via newly-enabled console log capture — libraries/react-shared-libraries/src/sentry/initialize.sentry.next.basic.ts:36-39
• 🟢 LOW Incomplete PII redaction allows user_id, org_id, and request_path to be sent to Sentry — libraries/helpers/src/utils/redact.log.attributes.ts:1-2

1 resolved finding

• Public API debug endpoints (/debug/posts, /debug/channels, /debug/activity) lack super-admin authorization — resolved in 55bac34

Review summary

This re-review of the staging→main batch confirmed the previously reported security findings remain present in the current commit, since none of the affected files changed since the last review. The still-open issues are: "Frontend console logs exported to Sentry via enabled console log capture" (console log capture enabled with sendDefaultPii and enableLogs in the shared Next.js Sentry initializer), "Incomplete PII redaction allows user_id, org_id, and request_path to be sent to Sentry" (the sensitive-key regex still does not match these identifier keys), "PII disclosure to Sentry through forced NestJS console logging" (backend bootstrap forces NestJS logs through console with Sentry console capture enabled), and "User-linked orchestrator email logs exported to Sentry via forced console routing" (orchestrator forces NestJS and Temporal worker logs through console with Sentry console capture enabled). All are log/PII-hygiene issues at low severity. The newly-changed code in the commit delta (the Stripe load-failure UI handling, the account-activation redirect body-skip fix, and the Instagram container error mapping) was reviewed and introduces no new security issues. No prior findings were resolved by this commit.

_{Fixed the findings? re-run the review, or tag @strix-security in a PR comment to run a fresh review.}

_{Updated for f1c3fa6.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}