Clean up for public release: drop broken examples, fix stale docs

.env.example

@@ -7,8 +7,8 @@ THREADS_APP_ID=
 # Your Threads app secret (from Meta Developer Portal)
 THREADS_APP_SECRET=
 
-# OAuth redirect URI (must match your app settings)
-# For local auth flow, use: http://localhost:8080/callback
+# OAuth redirect URI (must match your app settings; Threads requires https)
+# Default for the copy/paste login flow: https://localhost:8473/callback
 THREADS_REDIRECT_URI=
 
 # OAuth scopes (comma-separated). Request these in the Threads use case's
@@ -20,8 +20,8 @@ THREADS_SCOPES=threads_basic,threads_content_publish,threads_manage_insights,thr
 # This token is valid for ~60 days and can be refreshed
 THREADS_ACCESS_TOKEN=
 
-# Refresh token (optional, obtained via auth-local)
+# Refresh token (optional, obtained via 'threads login')
 THREADS_REFRESH_TOKEN=
 
-# Your Threads user ID (optional, auto-detected during auth-local)
+# Your Threads user ID (optional, auto-detected during 'threads login')
 THREADS_USER_ID=

CHANGELOG.md

@@ -6,12 +6,42 @@ The format is based on Keep a Changelog, and this project adheres to Semantic Ve
 
 ## [Unreleased]
 
-- Add `export` command: auto-paginates a user's posts/replies/mentions and
-  writes JSON or CSV, with optional `--with-insights` enrichment for posts.
-- Add a `tests/` suite covering the export command and its helpers.
-- Apply `ruff format` across the repo and ignore E402/E501 in `examples/`
-  scripts, so the unpinned-ruff CI lint step passes again.
+First public release. Highlights:
+
+### Onboarding & auth
+- `threads setup` — interactive onboarding: draft folder, OAuth callback port, and
+  Meta app credentials, with an offer to run login at the end.
+- `threads login` — OAuth via a copy/paste flow (Threads requires an https redirect,
+  so there is no localhost callback server); tokens are stored in `~/.threads/.env`
+  (mode 0600). `threads token refresh` and `threads debug-token` round it out.
+- `threads config` / `threads config set` — view or change content dir and callback
+  port without re-running setup. `threads status` — live token/account/quota check.
+- Login and token-refresh output **redacted** summaries — tokens are never printed.
+
+### Data
+- `threads export` — auto-paginates a user's posts/replies/mentions to JSON or CSV,
+  with optional `--with-insights` enrichment.
+- `threads snapshot` — one file with profile + posts (+insights) + replies + mentions
+  + followers count + quota, with `--since-days` windowing and per-section error
+  isolation for large accounts.
+- `threads insights`, `threads media`, `threads replies`, `threads user`,
+  `threads locations`, `threads oembed`.
+
+### Publishing (draft-first, human-approved)
+- `threads draft create | list | show | approve | reject | publish` — content is saved
+  as Markdown for review; `draft publish` refuses unless the draft is approved **and**
+  its text is unchanged since approval. The low-level `publish` command is internal and
+  bypasses the gate by design.
+
+### Agent distribution
+- `threads skills install` — installs the bundled skill into detected CLI agents
+  (Claude Code, Codex, …); `skills list` / `skills path` / `skills bundle` (zip for
+  Claude Desktop / Cowork).
+- Claude Code plugin + marketplace manifests (`/plugin marketplace add finolabs/threads-cli`).
+
+### Tooling
+- Test suite (pytest), `ruff` lint/format, and CI across Python 3.10–3.12.
 
 ## [0.1.0] - 2026-03-09
 
-- Initial open-source release.
+- Initial scaffold (superseded by the first public release above).

SECURITY.md

@@ -2,11 +2,21 @@
 
 ## Reporting a Vulnerability
 
-If you discover a security vulnerability, please **do not** open a public issue.
+Please **do not** open a public issue for security problems.
+
+Report privately through GitHub: open the repository's **Security** tab →
+**Report a vulnerability** (GitHub private vulnerability reporting). Include:
 
-Email the maintainer with:
 - a description of the issue
 - steps to reproduce
 - potential impact
 
-We will respond as soon as possible and coordinate a fix + disclosure timeline.
+We will acknowledge the report as soon as possible and coordinate a fix and
+disclosure timeline with you.
+
+## Scope notes
+
+- Credentials are stored locally in `~/.threads/.env` (mode `0600`) and are never
+  printed to stdout/stderr by the CLI. Never paste real tokens into issues or PRs.
+- The official Threads API passes the access token as a request parameter; this is
+  inherent to the Graph API, not specific to this tool.