Recordly is a desktop screen recorder for making demo and walkthrough videos look edited without hiring an editor. Record a screen or one app window with your microphone and system audio, and it opens straight into an editor that suggests zooms based on where your cursor was active, smooths the cursor's movement and places the video in a styled frame with wallpapers, gradients, padding, rounded corners and shadows.
The timeline lets you trim, add zoom regions by hand, speed up or slow down sections, crop, and add text, images, shapes and extra audio. You can add a webcam bubble that follows the zoom, and export MP4 or GIF with a choice of quality, frame rate and size. Projects save as .recordly files you can reopen. It also has local auto-captions, using whisper.cpp with a model it downloads from Hugging Face, and a community extension marketplace.
Recordly started as a fork of OpenScreen in March 2026 and says over 80% of the code has since diverged. It runs on macOS 14, Windows 10 (build 19041) and modern Linux, is AGPL-3.0 licensed and has about 36,000 stars and 86 contributors. The latest release is v1.4.0 from 8 September 2026, with a 2.0 beta in progress.
- Repository: github.com/webadderallorg/Recordly
- Licence: AGPL-3.0 (GNU Affero General Public License v3.0)
- Language: TypeScript. Stars: 36.4K. Forks: 2,990. Last push: Nov 9, 2026.
- Scan: safe, Nov 10, 2026, commit 0ea5bd7
Who it is for
Founders, developers and marketers making product demos, teachers and creators recording tutorials, and anyone who wants polished screen recordings without paying for a recorder.
Getting started
1. Download the app for Mac, Windows or Linux
https://github.com/webadderallorg/Recordly/releases/latest2. Or on Arch Linux from the AUR
yay -S recordly-bin3. Then: pick a screen or window, choose audio, record, and stop to open the editor
Record > Stop > Edit > ExportRecordly checks GitHub for updates every few hours; set RECORDLY_DISABLE_AUTO_UPDATES=1 to stop it. Our scan covers the source code, not the prebuilt installers.
Safety scan
We cloned webadderallorg/Recordly at commit 0ea5bd7 on Nov 10, 2026 and ran the checks described on the GitHub Tools page: credential patterns, decode-and-execute code, install-time scripts, committed binaries, risky CI workflows, every host the code talks to, known vulnerabilities in pinned dependencies, and project hygiene. A person read every hit. This is what we found.
- No secret hits and no pattern hits across 2,449 files and about 325,000 lines, mostly TypeScript.
- The 20 committed binaries are prebuilt native helpers in electron/native/bin: whisper.cpp v1.8.4 tools for captions, ScreenCaptureKit, window-list and cursor helpers for macOS, and Windows capture, cursor and GPU export programs. They do what the app describes, but you are trusting builds you cannot see the source of in that folder unless you rebuild them; the build scripts are in the repo.
- Installing from source runs a postinstall script. It downloads FFmpeg from the ffmpeg-static project's GitHub releases and checks SHA-256 hashes, then rebuilds native modules and the helpers. The release downloads skip all of this.
- 11 advisories, none critical. The 5 high (4 in undici, 1 in Zod) are in services/recordly-share/worker, the Cloudflare Worker behind the optional cloud sharing service, not the desktop app. The app's own lockfile has 2 moderate.
- The paid side, which the README leaves out. The app includes Recordly Cloud, a monthly subscription with Stripe checkout for shareable links and cloud storage. Its pricing screens list commercial use as a Cloud perk, and the export menu shows Upgrade for commercial use. The code itself is AGPL-3.0, which does not forbid commercial use, so if you record for paid work, check the current terms with the author.
- We found no analytics or tracking service in the app code; the matches for telemetry are about cursor movement. Hosts include GitHub for updates, Hugging Face for caption models, videos.recordly.dev for the optional cloud, and Reddit and X links in the extension marketplace.
- 8 workflows, none using pull_request_target. None of the 3 third-party actions is pinned to a commit. A licence and contributing guide are present; no security policy or Dependabot.
What the scanner counted
| Check | Result |
|---|---|
| Secrets | None found. |
| Suspicious code | None found. |
| Install-time code | 1 npm lifecycle script |
| Committed binaries | 20 executable or compiled objects committed; listed under the raw findings. |
| CI workflows | 8 workflows. None use pull_request_target. 3 of 3 third-party actions pinned to a tag rather than a commit. |
| Network hosts | 40 distinct hosts referenced from source; most often example.test, videos.recordly.dev, github.com, checkout.stripe.com. No URLs to bare IP addresses. |
| Known vulnerabilities | 11 advisories across 993 pinned packages: 0 critical, 5 high, 6 moderate, 0 low. package-lock.json: 619 packages, 2 advisories; services/recordly-share/worker/package-lock.json: 159 packages, 9 advisories; services/recordly-share/worker/web/package-lock.json: 487 packages, 0 advisories. |
| Project hygiene | Has licence file, contributing guide. Missing security policy, automated dependency updates, CodeQL. |
| OpenSSF Scorecard | Not scored: the project is not in Scorecard's weekly index. |
The raw findings
Every hit the scanner wrote out, with a link to the exact line at the scanned commit. Secrets candidates are redacted.
npm lifecycle scripts (1)
package.jsonpostinstall:node scripts/postinstall.mjs
Committed binaries (20)
electron/native/bin/darwin-arm64/whisper-server: Mach-O, 4 MBelectron/native/bin/darwin-arm64/whisper-cli: Mach-O, 3 MBelectron/native/bin/darwin-arm64/whisper-vad-speech-segments: Mach-O, 3 MBelectron/native/bin/darwin-arm64/whisper-bench: Mach-O, 2 MBelectron/native/bin/darwin-arm64/whisper-quantize: Mach-O, 2 MBelectron/native/bin/win32-x64/recordly-nvidia-cuda-compositor.exe: PE (Windows executable), 460 KBelectron/native/bin/darwin-arm64/recordly-screencapturekit-helper: Mach-O, 390 KBelectron/native/bin/darwin-x64/recordly-screencapturekit-helper: Mach-O, 375 KBelectron/native/bin/win32-x64/wgc-capture.exe: PE (Windows executable), 125 KBelectron/native/bin/darwin-arm64/recordly-window-list: Mach-O, 119 KBelectron/native/bin/darwin-arm64/openscreen-window-list: Mach-O, 116 KBelectron/native/bin/win32-x64/recordly-gpu-export.exe: PE (Windows executable), 111 KBelectron/native/bin/darwin-arm64/recordly-system-cursors: Mach-O, 102 KBelectron/native/bin/darwin-arm64/recordly-native-cursor-monitor: Mach-O, 101 KBelectron/native/bin/darwin-arm64/recordly-permission-drag-helper: Mach-O, 91 KBelectron/native/bin/darwin-x64/recordly-window-list: Mach-O, 89 KBelectron/native/bin/darwin-x64/recordly-native-cursor-monitor: Mach-O, 74 KBelectron/native/bin/darwin-x64/recordly-system-cursors: Mach-O, 71 KBelectron/native/bin/darwin-x64/recordly-permission-drag-helper: Mach-O, 60 KBelectron/native/bin/win32-x64/cursor-monitor.exe: PE (Windows executable), 26 KB
Worst known vulnerabilities (11 of 11)
| Advisory | Severity | Package | Summary |
|---|---|---|---|
| GHSA-2m5v-pch6-74hx | high | undici@7.29.1 | undici vulnerable to TLS certificate validation bypass via dropped tls options in Agent |
| GHSA-4w7w-5xrc-9h26 | high | undici@7.29.1 | undici vulnerable to cache poisoning and cross-user disclosure via cross-origin redirects |
| GHSA-qrxm-fqhp-jwvm | high | undici@7.29.1 | undici vulnerable to Denial of Service via TLS 1.2 certificate-changing renegotiation |
| GHSA-xjj6-f33q-929c | high | undici@7.29.1 | undici vulnerable to Denial of Service via unhandled error on excessive content-encodings |
| GHSA-mrhx-c7xc-m3w5 | high | zod@4.6.5 | Zod can exhaust memory while validating oversized constrained collections |
| GHSA-g3hv-75wg-m249 | moderate | minimatch@9.0.9 | minimatch has potential denial of service via globparts amplification |
| GHSA-g3hv-75wg-m249 | moderate | minimatch@10.2.6 | minimatch has potential denial of service via globparts amplification |
| GHSA-4qv8-2p9j-2685 | moderate | undici@7.29.1 | undici vulnerable to Denial of Service via unbounded memory in the EventSource parser |
| GHSA-55wc-3pg8-jfw6 | moderate | undici@7.29.1 | undici vulnerable to Denial of Service via unhandled exception in the decompress interceptor |
| GHSA-9fm3-97px-rjf6 | moderate | undici@7.29.1 | undici WebSocket client vulnerable to Denial of Service via unbounded automatic PONG buffering |
| GHSA-f72v-6w45-q472 | moderate | undici@7.29.1 | undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens |
By the numbers
| Stars | 36.4K |
|---|---|
| Forks | 2,990 |
| Contributors | 86 |
| Commits | 2,100 |
| Open issues | 276 |
| Open pull requests | 240 |
| Releases | 48 |
| Latest release | v1.4.0 |
| Licence | AGPL-3.0 |
| Main language | TypeScript |
| Project age | 8 months |
| Last push | Nov 9, 2026 |
| Tracked files | 2,449 |
| Lines of code | 325.2K |
| Checkout size | 140 MB |
Lines by language: TypeScript 254.7K, JSON 25.2K, JavaScript 16.9K, CSS 7,277, C++ 6,588, CUDA 3,314.
Questions
Is Recordly free?
Recording, editing and exporting are free, and the code is open source under AGPL-3.0. Recordly Cloud is an optional monthly subscription for shareable links and cloud storage, and the app presents it as the plan for commercial use.
Does Recordly add a watermark?
The README does not mention one, and we found no watermark feature in the app's code.
Does it work on Linux?
Yes, through Electron's capture. The README notes that Linux cannot hide the real cursor yet, so you may see both the real and the styled cursor, and system audio usually needs PipeWire.
How is it different from Cap?
Both are open-source screen recorders. Cap, which we list in this GitHub section too, is built around quick shareable recordings; Recordly puts more into editing polish such as automatic zooms, cursor effects and styled frames.
This post is part of GitHub Tools, where every repository is cloned and scanned before it is written up. The scan is a snapshot of one commit on one day; the repository has moved on since, so check it before you install.
