Field notesOct 18, 20264 min read

I built a read-only social media extractor. Here is the security design.

A small research tool that pulls captions, hashtags and links from public posts, and is physically unable to like, post or log in.

Competitor research used to mean copying captions and hashtags by hand into a doc. So I built a small tool that does it, with one rule above all others: it can read, and it can do nothing else.

What it does

  • Takes a public Instagram or TikTok URL, or a file full of them.
  • Extracts author, caption, hashtags, mentions, links, engagement and media references.
  • Writes a Markdown report for people and a JSON file for agents.

The security design

  • No logins and no API keys. Public content only.
  • No state changes: it never likes, follows, comments or posts.
  • Rate-limited with random delays between requests.
  • Output stays on the local machine.
  • Deterministic: the same URL produces the same report.

It tries a fast static fetch first and only falls back to a real browser when a page needs JavaScript. That keeps it fast and polite.

Extract without touching. Read without logging in. Report without leaking.

What it is for

It feeds research: what competitors post, which formats break out, what the comments ask for. It is the first step in my content pipeline, and a good example of the least complex tool that does the job.

Get next week's update.

One workflow, one number, one giveaway, every week. Unsubscribe anytime.

One email a week at most. Unsubscribe anytime.

Want this in your business, not just on your screen?

Book the free audit: one hour, a one-page map in 48 hours.

Book your free AI audit