A security review of the publishing pipeline before the first campaigns. Publish now and Cancel used to be open to any member of the organization on any post, Publish now included drafts and posts in review and skipped the checks every other send runs; both now belong to the author, an owner or an admin, and Publish now works on scheduled posts only, through the same send as everything else. A page on another site can no longer drive the app with your session (cross-site requests are refused). Accounts connected by another organization on the shared publishing provider can no longer appear as yours. A file uploaded from the composer must be the picture or video its name says. Token permission groups are read exactly as the action is run, and deleting a published post counts as publishing. The webhook signing secret of a brand is shown to owners and admins only.