Explanation of the substack-gateway

[J-avery32]

Is there an explanation of the substack-gateway somewhere? I don't understand what this is. Is this owned by Substack or is it run by someone maintaining this project? Is there source code for it if the latter is the case?

[dknell]

@jakub-k-slys Following up on @J-avery32's question here - I'd also like to understand the role of the substack-gateway.

Looking at the code, all API requests are routed through substack-gateway.vercel.app, and the library sends users' substack_sid and connect_sid session cookies (base64-encoded as a Bearer token) to this server on every request. Since these cookies provide full access to a user's Substack session, this raises a significant security concern - the gateway operator could read, store, or misuse those credentials without the user's knowledge.

From what I can tell, there's no technical reason this needs to go through an external proxy. Since this is a Node.js library, it could make authenticated requests directly to Substack's API using the session cookies, without any CORS or browser restrictions. The response normalization the gateway does could also be handled in the TypeScript service layer.

Would you be willing to:

1. Open-source the gateway code so users can audit what's running on that server?
2. Consider removing the gateway dependency entirely in favor of direct Substack API calls?

I appreciate the work you've put into this library - just want to make sure it's safe to use with real credentials. Thanks!

[jakub-k-slys]

Hey! Thank you for reaching out. Substack Gateway is a concept that I am currently developing. The primary objective of this project is to provide MCP capabilities that are analogous to the Substack API. Additionally, I aim to establish a centralized point of control for troubleshooting and resolving issues, ensuring that these do not adversely affect other components, such as n8n-nodes-substack. Consequently, I have relocated these functionalities from the Substack API to Substack Gateway, enabling their reuse and the creation of succinct REST and MCP endpoints.

However, to address security and transparency concerns, I have reverted the code base of both the Substack API and Substack Node (n8n) to the point at which they directly interact with backend servers.

Regarding the gateway, once it has been stabilized, I intend to open source it as well.