Changelog

Documentation pages

• Four guides were published: Setup, Posting, Tokens & keys, and Troubleshooting.
• They are linked from the Resources section of the menu and cross-link to each other.

Faster pages and a few polish items

• Light or dark now follows your device by default, and the logo's arrows switch to white in dark mode.
• The footer carries switches for appearance and the design system's server-rendered mode.
• Pages load ahead of time when you open the menu, so moving between pages is near-instant.
• Added a keyboard 'Skip to content' shortcut and a proper page for addresses that don't exist.
• Signing in with Google now completes correctly instead of returning to the home page.

tweet.app now needs your own connection

• tweet.app changed its API so it no longer answers public requests — reading your posts now requires a signed-in token.
• Setup step 1 is new: paste your own tweet.app access token, with a guide for finding it and a Test connection button.
• Your token is stored encrypted and never sent back to your browser; clearing it stops all reading immediately.
• Errors now read in plain language, and automatic posting pauses instead of retrying every hour when a connection is broken.

“2.) API locked down. No more (intentionally) public APIs ATM.” — @punkrokk on tweet.app

New logo, social cards and app icons

• The Crosspost mark — the repeat arrows around a bird — now appears in the header, browser tab, and installed app icons.
• Shared links show a proper preview image.

Menu, terms and privacy pages

• A menu was added with sign in, register and every public page.
• Terms of Service and Privacy Policy pages were published, along with the independence disclaimer in the footer.

One set of X keys with a mode you choose

• Crosspost now keeps a single set of X developer keys and lets you say whether they came from Development, Staging or Production.
• Detailed key guidance moved into a collapsible section, with a recommendation to test in Development first.

Security hardening

• Stored X keys are unreachable from any browser — only trusted server code can use them.
• Dependency updates closed known vulnerabilities, and the two-factor code entry no longer blocks the sixth digit.