Sendible

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Build me the agency social tool that replaces Sendible.

The agency features are the product, and one of them is a security requirement rather than a convenience: **one client must never be able to see another's anything.**

STACK
- Node 20+ with Fastify, server-rendered HTML with a little vanilla JS
- SQLite through better-sqlite3, WAL mode
- A worker for publishing and collection
- Caddy in front

THE DATA MODEL
- clients: id, name, brand_json
- memberships: id, user_id, client_id, role — every query filters on this, without exception
- accounts, posts, targets, metrics as in any scheduler, all carrying client_id
- approvals: id, post_id, requested_at, decided_by, decision, note, decided_at
- **Every query joins memberships. Not most queries — every one.** A single endpoint that forgets is a cross-client data leak, which for an agency is a lost account and possibly a lawsuit

APPROVALS, THE FEATURE AGENCIES BUY
- A post enters 'awaiting approval', the client sees a preview per network, and approves or asks for a change with a comment
- **A token link, no account required.** The single biggest failure of approval workflows is that the client will not create a login, and then approvals happen in email anyway
- Changes after approval reset it. A post approved as one thing and published as another is how an agency loses trust in one afternoon
- Every decision recorded with who and when, permanently

PUBLISHING
- A queue with a lease, idempotency per target, remote checked before any retry
- Per-network validation at composition time and a preview per network
- Token refresh in the background with an alert before expiry, per client account
- Failures visible per client, because 'did their posts go out' is asked every morning

WHITE-LABEL REPORTING
- Reports generated per client with their branding, on a schedule, delivered without anybody remembering
- Every figure carrying its collection date, since networks revise them
- An annotations timeline so a spike has an explanation attached
- **A written summary field on every report.** The numbers are the evidence; the sentence is the service

PERMISSIONS
- Roles: agency admin, account manager, client reviewer. A reviewer sees one client's calendar and approvals and nothing else
- Every access checked on the server, default deny, and cross-client access attempts logged

CARE
- Alt text required before scheduling
- A shared calendar per client with a month view, which is the screen everybody actually lives in

WHAT MATTERS MOST
Membership filtering on every query, and approvals by token link. The first is a security boundary; the second is whether the workflow is used at all.