athcagithub/postiz-leaked

Treat this as read-only evidence of how a commercial social scheduler is built, not as a shortcut to a running product. The README is a note from a self-described former Postiz CMO who says he was fired and published the full source; there is no setup documentation beyond docker compose up and a pointer to the paid hosted service.

The problem

You want to schedule posts across many social platforms and are curious whether you can run something like Postiz yourself instead of paying a subscription. Normally that path starts with a maintained self-host guide and a known-good release. Here you get the vendor's own admitted scope: an entire codebase covering scheduling to 30+ platforms, an AI agent and analytics, but no onboarding material and no indication of which version or commit was published. The workflow changes from "install a supported product" to "read a code snapshot and decide whether it is worth reconstructing." The result is reference material, not a turnkey deployment.

What's different

What makes this unusual is provenance: the README frames the release as an act of retaliation and then, without irony, points readers back to the paid service, saying it handles the operational work for you project README. The codebase itself is presented as feature-complete, with scheduling, an AI agent and analytics included, under AGPL-3.0 license.

That scope is precisely the trade-off. A social scheduler is only useful if each platform's OAuth app is registered and approved and its API stays current; the README lists that burden explicitly, including app review for every platform and paying for X's API project README. Publishing source removes none of that work. Self-hosting here means building your own deployment around a code dump of unexplained provenance and keeping it in step with platform API changes, which is a business process as much as a technical one.

There is also a licensing question. AGPL-3.0 is a real open-source license, but it governs the code the publisher had the right to release. Whether this particular publication was authorised is not something the README or repository data establishes.

Who should try it

Good fit: developers evaluating how a multi-platform scheduler handles connectors, queues and analytics, or auditing whether the paid Postiz service is worth its price by inspecting the work behind it. Also reasonable for someone curious about the incident itself and the codebase it exposed repository.

Poor fit: a team wanting a working self-hosted scheduler next week. Without a version tag, release notes or migration guidance, and with platform app reviews as a hard gate, this is not a drop-in replacement for the subscription. Anyone hoping for community support should note that the publication is a one-off README with no stated maintenance intent.

Requirements and limitations

The README documents only docker compose up, then leaves you to provision a database, Redis and storage, register OAuth apps for every social platform, get each through app review, and pay for X API access project README. Every one of those is a blocking prerequisite for actually posting, not a nice-to-have. The missing piece is arguably the biggest: no stated commit, version or changelog, so you cannot tell how current this snapshot is relative to the platforms' APIs. Ongoing upkeep includes patching against platform changes, which the README itself names as the reason to pay for the hosted option hosted service.

HotRepo's take

HotRepo recorded 128 total stars and a #9 position on its NEW-REPOSITORY board (not the overall Trending board) on 2026-10-26, the project's only recorded date repository. With a single sample and insufficient daily-board history, persistence cannot be judged. Before investing effort, check whether the repository states which version was published and whether any license or takedown response has since appeared.