Postiz

gitroomhq/postiz-appReviewed by AI

What it does

A social media management app you host yourself: one calendar to write, schedule and cross-post to X, Instagram, YouTube, TikTok, LinkedIn, Reddit, Facebook, Threads, Pinterest, Discord, Slack, Mastodon and Bluesky, with analytics, team members, a public API and AI writing help. You use it in a browser. Running it means Docker with PostgreSQL, Redis and a Temporal stack, and creating your own developer app on each network, which the README says Meta, YouTube and TikTok can take weeks to approve. The same product is also sold as a paid hosted service.

How easy it is to install

D · terminal, several tools or a specific graphics card · Windows

Windows D
macOS D
Linux D
Web D

The 204 releases carry no installer, so the published way in is the docker-compose file: Linux is the natural home for it and sets the grade, since it starts Postiz plus PostgreSQL, Redis, Temporal and Elasticsearch, and you then fill in dozens of settings before opening http://localhost:4007 in a browser. Windows and macOS need Docker Desktop for the same stack; the browser grade matches because the page only exists once that server is running.

Coming soon: install in 1 click with the RepoPicks app.

Numbers on GitHub

Stars: 40,377on Oct 31, 2026
Downloads: —all releases
Growth: +1,922stars in 5 days

Stars over time

Facts

Runs on: Windows, macOS, Linux, Web
You need to install: Docker
To build from source: Node.js, Docker
Disk space: 100 MB–500 MB · estimate
Accounts or keys: Your own developer app on each social network (X, LinkedIn, Facebook, Threads, YouTube, TikTok, Reddit, Pinterest, Discord, Slack, Mastodon and others), OpenAI, Cloudflare R2 storage, Resend (activation e-mails)
Cost: Freemium · Self-hosting is free under AGPL-3.0 ("Free forever"; you pay for your own server). Postiz Cloud is a subscription per plan with a 7-day trial.
License: AGPL-3.0 (Copyleft)
Can replace: Buffer, Hootsuite, Later
Last update: Oct 31, 2026

Risk signals (6)

AttentionDependencies with known vulnerabilities
Pinned dependencies with known vulnerabilities (OSV): @sentry/nextjs: GHSA-mchm-gjx6-7h55; sweetalert2: GHSA-457r-cqc8-9vj9, GHSA-8jh9-wqpf-q52c, GHSA-pg98-6v7f-2xfv
automatic check
Attentionplaceholder secrets in compose file
docker-compose.yaml ships JWT_SECRET: 'random string that is unique to every install - just type random characters here!' and a fixed database password (POSTGRES_PASSWORD: postiz-password). Copying it unchanged onto a server reachable from the internet leaves the login token secret and the database password public.
AI review
Attentionopen mcp client registration by default
.env.example, about DCR_VERIFIED_DOMAINS: "When set (comma separated), POST /oauth/register only accepts redirect_uris whose host matches a listed domain or one of its subdomains; unset or empty means any client can self-register." The variable is commented out in the example.
AI review
Infoown platform apps and approval needed
README comparison table, self-hosted column: "You create your own developer apps on each platform and go through their approval (Meta, YouTube, TikTok can take weeks)". Analytics also "requires your own app credentials with analytics scopes".
AI review
Infoheavy server stack
docker-compose.yaml starts nine containers: Postiz, postgres:17-alpine, redis:7.2, Sentry Spotlight, elasticsearch:7.17.27, a second postgres:16, temporal auto-setup, admin tools and the Temporal UI. Not something a normal laptop runs in the background.
AI review
Infonetwork copyleft license
LICENSE is AGPL-3.0: "public use of a modified version, on a publicly accessible server, gives the public access to the source code of the modified version". If you change Postiz and let others use it over the network, you must share your changes.
AI review

Evidence is shown in its original language.

What Radar could not check

Whether each network still accepts your own developer app, and how long the approval takes
How much memory and disk the full container stack really needs on your server
What the AI writing, image, video and clipping features cost once you plug in your own provider keys
Whether the published ghcr.io image matches the code in this repository
Whether posting and analytics keep working after each platform changes its API