Postiz schedules and publishes social media content. It is open source and it is not mine: it belongs to its maintainers and the community around it. I am one of three maintainers.
What it is
Postiz schedules and publishes social media content across platforms. It is genuinely open source, which makes it the one thing on this page with a licence I do not control.
What I do on it
I am Chief Operations & Security Officer. The CVE Numbering Authority I run for it is also GCVE Numbering Authority 125. On a team of three that is a hands-on job, not an administrative one: the CVE Numbering Authority programme, the release pipeline, the monitoring, and the support desk all sit with me.
I am also the second-largest contributor to the core postiz-app repository, at 405 commits, behind the founder and ahead of everyone else.
The work page has the detail on what the role covers.
The security side
This is the part of the role with a public record, so it is the part worth being specific about.
Postiz has 17 published advisories and 15 CVEs. Three are critical. The highest scored 10.0, an arbitrary code execution and token exfiltration issue in a CI workflow. The next, at 9.9, was a super-admin takeover through JWT forgery in a third-party auth provider path.
The largest single cluster is server-side request forgery, eight advisories deep, spanning webhook creation, RSS fetching, a URL loader, an upload-from-URL endpoint, a public streaming endpoint and a redirect bypass. One of them was a TOCTOU DNS rebinding issue that defeated every URL validation path at once.
They cluster like that for a reason. A social scheduler exists to fetch and post things on your behalf, so its whole job description is "make outbound requests to attacker-influenced URLs". SSRF is not a bug class this product stumbled into. It is the product's shape, and it needs treating structurally rather than one endpoint at a time.
Payment paths are the other recurring theme: an unauthenticated lifetime PRO grant through a payments webhook, a billing-enforcement bypass, and forgeable lifetime-deal redemption codes.
Beyond the core repository
The work spreads across the surrounding repositories too. The documentation site, the deployment compose stack, and the support bot that runs the Discord side of the support desk are all part of the same job. The support bot is a system rather than a config file, and is described in its own entry.
Why it is listed separately from GHub
Different ownership, different licence, different obligations. GHub is open core and mine. Postiz is open source and shared. Collapsing the two would misrepresent both.