MrTechKing

5 min read

Recordly: Polished Screen Recordings With Auto-Zoom, Free and Open Source (GitHub, Scanned)

Record your screen, then add automatic zooms, a smooth cursor, a webcam bubble and a styled frame. Exports MP4 or GIF.

Recordly logo
✅
Scan: safe. Nothing malicious and no analytics found. Know that the repo commits 20 prebuilt helper programs, and that the app pitches a paid Cloud plan for commercial use that the README does not mention. Scanned Nov 10, 2026; the full report is below.

Recordly is a desktop screen recorder for making demo and walkthrough videos look edited without hiring an editor. Record a screen or one app window with your microphone and system audio, and it opens straight into an editor that suggests zooms based on where your cursor was active, smooths the cursor's movement and places the video in a styled frame with wallpapers, gradients, padding, rounded corners and shadows.

The timeline lets you trim, add zoom regions by hand, speed up or slow down sections, crop, and add text, images, shapes and extra audio. You can add a webcam bubble that follows the zoom, and export MP4 or GIF with a choice of quality, frame rate and size. Projects save as .recordly files you can reopen. It also has local auto-captions, using whisper.cpp with a model it downloads from Hugging Face, and a community extension marketplace.

Recordly started as a fork of OpenScreen in March 2026 and says over 80% of the code has since diverged. It runs on macOS 14, Windows 10 (build 19041) and modern Linux, is AGPL-3.0 licensed and has about 36,000 stars and 86 contributors. The latest release is v1.4.0 from 8 September 2026, with a 2.0 beta in progress.

  • Repository: github.com/webadderallorg/Recordly
  • Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
  • Language: TypeScript. Stars: 36.4K. Forks: 2,990. Last push: Nov 9, 2026.
  • Scan: safe, Nov 10, 2026, commit 0ea5bd7

Who it is for

Founders, developers and marketers making product demos, teachers and creators recording tutorials, and anyone who wants polished screen recordings without paying for a recorder.

Getting started

1. Download the app for Mac, Windows or Linux

https://github.com/webadderallorg/Recordly/releases/latest

2. Or on Arch Linux from the AUR

yay -S recordly-bin

3. Then: pick a screen or window, choose audio, record, and stop to open the editor

Record > Stop > Edit > Export

Recordly checks GitHub for updates every few hours; set RECORDLY_DISABLE_AUTO_UPDATES=1 to stop it. Our scan covers the source code, not the prebuilt installers.

Safety scan

We cloned webadderallorg/Recordly at commit 0ea5bd7 on Nov 10, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.

  • No secret hits and no pattern hits across 2,449 files and about 325,000 lines, mostly TypeScript.
  • The 20 committed binaries are prebuilt native helpers in electron/native/bin: whisper.cpp v1.8.4 tools for captions, ScreenCaptureKit, window-list and cursor helpers for macOS, and Windows capture, cursor and GPU export programs. They do what the app describes, but you are trusting builds you cannot see the source of in that folder unless you rebuild them; the build scripts are in the repo.
  • Installing from source runs a postinstall script. It downloads FFmpeg from the ffmpeg-static project's GitHub releases and checks SHA-256 hashes, then rebuilds native modules and the helpers. The release downloads skip all of this.
  • 11 advisories, none critical. The 5 high (4 in undici, 1 in Zod) are in services/recordly-share/worker, the Cloudflare Worker behind the optional cloud sharing service, not the desktop app. The app's own lockfile has 2 moderate.
  • The paid side, which the README leaves out. The app includes Recordly Cloud, a monthly subscription with Stripe checkout for shareable links and cloud storage. Its pricing screens list commercial use as a Cloud perk, and the export menu shows Upgrade for commercial use. The code itself is AGPL-3.0, which does not forbid commercial use, so if you record for paid work, check the current terms with the author.
  • We found no analytics or tracking service in the app code; the matches for telemetry are about cursor movement. Hosts include GitHub for updates, Hugging Face for caption models, videos.recordly.dev for the optional cloud, and Reddit and X links in the extension marketplace.
  • 8 workflows, none using pull_request_target. None of the 3 third-party actions is pinned to a commit. A licence and contributing guide are present; no security policy or Dependabot.

What the scanner counted

CheckResult
SecretsNone found.
Suspicious codeNone found.
Install-time code1 npm lifecycle script
Committed binaries20 executable or compiled objects committed; listed under the raw findings.
CI workflows8 workflows. None use pull_request_target. 3 of 3 third-party actions pinned to a tag rather than a commit.
Network hosts40 distinct hosts referenced from source; most often example.test, videos.recordly.dev, github.com, checkout.stripe.com. No URLs to bare IP addresses.
Known vulnerabilities11 advisories across 993 pinned packages: 0 critical, 5 high, 6 moderate, 0 low. package-lock.json: 619 packages, 2 advisories; services/recordly-share/worker/package-lock.json: 159 packages, 9 advisories; services/recordly-share/worker/web/package-lock.json: 487 packages, 0 advisories.
Project hygieneHas licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL.
OpenSSF ScorecardNot scored: the project is not in Scorecard's weekly index.

The raw findings

Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.

npm lifecycle scripts (1)
  • package.json postinstall: node scripts/postinstall.mjs
Committed binaries (20)
  • electron/native/bin/darwin-arm64/whisper-server: Mach-O, 4 MB
  • electron/native/bin/darwin-arm64/whisper-cli: Mach-O, 3 MB
  • electron/native/bin/darwin-arm64/whisper-vad-speech-segments: Mach-O, 3 MB
  • electron/native/bin/darwin-arm64/whisper-bench: Mach-O, 2 MB
  • electron/native/bin/darwin-arm64/whisper-quantize: Mach-O, 2 MB
  • electron/native/bin/win32-x64/recordly-nvidia-cuda-compositor.exe: PE (Windows executable), 460 KB
  • electron/native/bin/darwin-arm64/recordly-screencapturekit-helper: Mach-O, 390 KB
  • electron/native/bin/darwin-x64/recordly-screencapturekit-helper: Mach-O, 375 KB
  • electron/native/bin/win32-x64/wgc-capture.exe: PE (Windows executable), 125 KB
  • electron/native/bin/darwin-arm64/recordly-window-list: Mach-O, 119 KB
  • electron/native/bin/darwin-arm64/openscreen-window-list: Mach-O, 116 KB
  • electron/native/bin/win32-x64/recordly-gpu-export.exe: PE (Windows executable), 111 KB
  • electron/native/bin/darwin-arm64/recordly-system-cursors: Mach-O, 102 KB
  • electron/native/bin/darwin-arm64/recordly-native-cursor-monitor: Mach-O, 101 KB
  • electron/native/bin/darwin-arm64/recordly-permission-drag-helper: Mach-O, 91 KB
  • electron/native/bin/darwin-x64/recordly-window-list: Mach-O, 89 KB
  • electron/native/bin/darwin-x64/recordly-native-cursor-monitor: Mach-O, 74 KB
  • electron/native/bin/darwin-x64/recordly-system-cursors: Mach-O, 71 KB
  • electron/native/bin/darwin-x64/recordly-permission-drag-helper: Mach-O, 60 KB
  • electron/native/bin/win32-x64/cursor-monitor.exe: PE (Windows executable), 26 KB
Worst known vulnerabilities (11 of 11)
AdvisorySeverityPackageSummary
GHSA-2m5v-pch6-74hxhighundici@7.29.1undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent
GHSA-4w7w-5xrc-9h26highundici@7.29.1undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects
GHSA-qrxm-fqhp-jwvmhighundici@7.29.1undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation
GHSA-xjj6-f33q-929chighundici@7.29.1undici vulnerable to Denial of Service via unhandled error on excessive content-encodings
GHSA-mrhx-c7xc-m3w5highzod@4.6.5Zod can exhaust memory while validating oversized constrained collections
GHSA-g3hv-75wg-m249moderateminimatch@9.0.9minimatch has potential denial of service via globparts amplification
GHSA-g3hv-75wg-m249moderateminimatch@10.2.6minimatch has potential denial of service via globparts amplification
GHSA-4qv8-2p9j-2685moderateundici@7.29.1undici vulnerable to Denial of Service via unbounded memory in the EventSource parser
GHSA-55wc-3pg8-jfw6moderateundici@7.29.1undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor
GHSA-9fm3-97px-rjf6moderateundici@7.29.1undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering
GHSA-f72v-6w45-q472moderateundici@7.29.1undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens

By the numbers

Stars36.4K
Forks2,990
Contributors86
Commits2,100
Open issues276
Open pull requests240
Releases48
Latest releasev1.4.0
LicenceAGPL-3.0
Main languageTypeScript
Project age8 months
Last pushNov 9, 2026
Tracked files2,449
Lines of code325.2K
Checkout size140 MB

Lines by language: TypeScript 254.7K, JSON 25.2K, JavaScript 16.9K, CSS 7,277, C++ 6,588, CUDA 3,314.

Questions

Is Recordly free?

Recording, editing and exporting are free, and the code is open source under AGPL-3.0. Recordly Cloud is an optional monthly subscription for shareable links and cloud storage, and the app presents it as the plan for commercial use.

Does Recordly add a watermark?

The README does not mention one, and we found no watermark feature in the app's code.

Does it work on Linux?

Yes, through Electron's capture. The README notes that Linux cannot hide the real cursor yet, so you may see both the real and the styled cursor, and system audio usually needs PipeWire.

How is it different from Cap?

Both are open-source screen recorders. Cap, which we list in this GitHub section too, is built around quick shareable recordings; Recordly puts more into editing polish such as automatic zooms, cursor effects and styled frames.


This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.