I documented how PostPilot handles various problems and the safeguards it employs.
Publish deduplication uses the same claim pattern on scheduled to publishing.
Publisher retry policy: 3 attempts with growing delay, then failed with the error.
Slack request verification uses HMAC‑SHA256 over v0:{ts}:{body}, 5 minute window, constant‑time compare.
OAuth security employs PKCE S256, random state, single use, 10 minute TTL, bound to provider.
OAuth tokens are Fernet encrypted with a key derived from POSTPILOT_SECRET_KEY.
Model‑generated URLs: Only URLs the user supplied are fetched.
SSRF protection: Public addresses only, every resolved IP checked (NAT64 unwrapped), no redirects, 200 KB cap.
Model degradation: Each step degrades alone: template drafter, default tool plan.
API authentication: All /api endpoints need Authorization: Bearer <POSTPILOT_TOKEN> (default pp-demo-token).
System limits: Single user, SQLite, single process. The in‑process scheduler is not a distributed queue.
Concurrency control: WHERE status=` claim, second caller gets 409.
Demo defaults: POSTPILOT_TOKEN and POSTPILOT_SECRET_KEY are demo‑only defaults.
Roadmap items: image attachments, reply drafting, per‑account brand voices, recovery of stuck publishing posts, multi‑user roles.