beehiiv switch-ready: everything needed before inviting beehiiv switchers #79

Background

People are leaving beehiiv after a ~42% price rise (e.g. Nevo David, Postiz founder: x.com/wickedguro/status/2111362653004140600). They mostly want MCP, a scheduler and their own SES, but they fear warm-up and need to bring their list with them. MailCheap and others are already pitching in those threads. This issue tracks everything needed before we invite beehiiv switchers to app.sendlit.app. Audit: 19 Oct 2026 against main 7ce6795.

Already in place: scheduled broadcasts, MCP at api.sendlit.app/mcp with broadcast/contact tools, one-click unsubscribe (#55), mailing-address footer, suppression list, and bounce/complaint handling for SES (#58), Mailgun, SendGrid, Postmark and Resend.

Blockers (must ship before inviting)

Sub-issues: #38 CSV import, #59 MCP key management (fix in PR #78), #66 billing on main, #67 warm-up guide + daily caps, #75 hosted abuse prevention (with #71, #72, #73, #74), #51 send-rate limit, #41 exclude filter ignored, #34 test send, #35 plain-text part.

Not tracked as issues:

• Legal pages on sendlit.app (FrontLit content): Terms and Privacy currently empty; add Terms, Privacy, Acceptable Use / anti-spam policy and DPA, linked from the footer
• Rajat verifies self-serve signup on app.sendlit.app with a fresh email
• Merge PR docs: add SECURITY.md #77 (SECURITY.md) and turn on GitHub private vulnerability reporting
• Merge PR fix(mcp): deny API key management to team API keys #78 (MCP key fix)

Week one after inviting

Sub-issues: #25 auto-pause on bounce/complaint rates, #40 unsubscribe on complaint, #27 signup form + double opt-in, #63 web version of issues, #4 SPF/DKIM/DMARC guidance, #68 migration guides, #70 SECURITY.md, #69 status page, #47 Reply-To, #76 Postmaster/SNDS reputation, #5 warm-up scheduler.

• Tag v0.1.0 (publishes Docker image) with changelog

Acceptance criteria

• All blocker sub-issues closed
• A beehiiv CSV export can be imported end to end with statuses mapped correctly
• A new account can sign up, connect SES, send a test, schedule a broadcast and pay
• Legal pages live and linked from the footer
• Week-one sub-issues closed or scheduled