Ship staging to production

[postiz-contribution]

In this batch

No merged PRs in this batch yet.

Before you merge

• New environment variables (92): AGENT_API_KEY, AGENT_MEDIA_SSO_KEY, APPLE_APP_BUNDLE_ID, BACKEND_URL, CHATBASE_TOKEN, DATAFAST_API_KEY, DATAFAST_WEBSITE_ID, DISABLE_IMAGE_COMPRESSION, DISABLE_REGISTRATION, DISABLE_SSRF_PROTECTION, DISABLE_X_ANALYTICS, DISALLOW_PLUS and 80 more. Set them on production before merging.
• Environment variables no longer referenced (3): APPLE_BUNDLE_ID, APPLE_SERVICE_ID, EMAIL_FROM_ADDRESS.
• Dependencies (2): package.json, pnpm-lock.yaml
• Infrastructure and deploy config (1): docker-compose.dev.yaml

[postiz-agent]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[strix-security]

Strix Security Review

6 open security findings on this PR:

• 🟢 LOW Frontend console logs exported to Sentry via newly-enabled console log capture — libraries/react-shared-libraries/src/sentry/initialize.sentry.next.basic.ts:52-55
• 🟢 LOW User-linked orchestrator email logs exported to Sentry via forced console routing — apps/orchestrator/src/main.ts:46
• 🟢 LOW PII disclosure to Sentry through forced NestJS console logging — apps/backend/src/main.ts:25
• 🟢 LOW Incomplete PII redaction allows user_id, org_id, and request_path to be sent to Sentry — libraries/helpers/src/utils/redact.log.attributes.ts:1-2
• 🟢 LOW Incomplete PII redaction allows user_id, org_id, and request_path to be sent to Sentry — libraries/helpers/src/utils/redact.log.attributes.ts:1-2
• 🟢 LOW Frontend console logs exported to Sentry via newly-enabled console log capture — libraries/react-shared-libraries/src/sentry/initialize.sentry.next.basic.ts:53

1 resolved finding

• Public API debug endpoints (/debug/posts, /debug/channels, /debug/activity) lack super-admin authorization — resolved in 55bac34

Review summary

Reviewed the pull request's commit delta (README.md, apps/frontend/src/components/new-launch/add.edit.modal.tsx, libraries/react-shared-libraries/src/helpers/uppy.upload.ts) plus the staging->main production code changes. The delta consists of defensive fixes (a null-check that closes the edit modal instead of crashing, and upload error propagation) and introduces no new vulnerabilities. The broader production changes are observability additions, defensive null checks, and provider error-classification fixes; no new high- or medium-impact issues were found. The previously reported Sentry logging and PII findings remain present and unchanged: "PII disclosure to Sentry through forced NestJS console logging", "User-linked orchestrator email logs exported to Sentry via forced console routing", "Frontend console logs exported to Sentry via newly-enabled console log capture", and "Incomplete PII redaction allows user_id, org_id, and request_path to be sent to Sentry".

_{Fixed the findings? re-run the review, or tag @strix-security in a PR comment to run a fresh review.}

_{Updated for c600209.}

---

Reviewed by Strix
_{Re-run review · Configure security review settings}