A translation platform for gettext .po / .pot, i18next JSON, CSV, and XLIFF files — edit, translate, and collaborate in the browser.

• Edit gettext .po / .pot, i18next JSON, CSV, and XLIFF files in the browser
• Translate entries and batches through DeepL, Azure Translator, or Gemini — switch providers at any time
• Translation memory — reuse approved translations across files with exact and fuzzy matching, import / export as JSON or TMX
• QA checks — catch broken placeholders, mismatched HTML tags, ICU variable drift, glossary conflicts, and more before export
• Text-to-speech — play strings with browser TTS or ElevenLabs BYO cloud voices
• Auto-save local drafts in the browser, including review state

• Projects — group translation files by project, manage target languages, and track progress
• Organizations — create teams, invite members, and manage permissions
• Review workflow — assign per-entry statuses (draft, in-review, approved, needs-changes), add threaded comments with resolution tracking, lock approved translations from further edits, and view change history
• Repo sync — open files directly from GitHub or GitLab, commit changes, and create pull / merge requests without leaving the editor
• Explore — browse and discover public translation projects

• Load WordPress.org glossary data and sync it to DeepL glossaries
• Inspect plugin source references through proxied SVN lookups
• Gemini translations include WordPress source file context for improved accuracy

• Dashboard — overview of projects, recent activity, and quick access
• Onboarding — guided setup flow for new users
• Cloud settings sync — optionally sync settings across devices with AES-256-GCM encrypted credential storage
• Billing — subscription management via Polar.sh
• Public roadmap — vote on and track upcoming features

Requires pnpm v10+ and Node.js v22+.

pnpm install --frozen-lockfile
cp .env.example .env.local
pnpm run supabase:start
# then fill in VITE_SUPABASE_ANON_KEY from `pnpx supabase status -o env`
pnpm run dev

VITE_SUPABASE_URL=http://127.0.0.1:54321
VITE_SUPABASE_ANON_KEY=your-local-anon-key
VITE_TURNSTILE_SITE_KEY=your-cloudflare-turnstile-site-key

Environment templates:

• .env.local for supabase start local development
• .env.staging for the hosted staging project, using .env.staging.example
• .env.production for the hosted production project, using .env.production.example

Real environment files stay untracked. Only the example templates are committed.

Run pnpm run to see all available scripts.

.github/workflows/cloudflare-pages.yml deploys the Vite build to Cloudflare Pages: main updates the production environment, pull requests get preview branches. The target project is set via the CLOUDFLARE_PAGES_PROJECT secret (falls back to the GitHub repo name).

A Cloudflare Pages Function at functions/ingest/ reverse-proxies PostHog analytics events.

Required GitHub repository secrets: CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN, CLOUDFLARE_PAGES_PROJECT, VITE_SUPABASE_URL, VITE_SUPABASE_ANON_KEY, VITE_TURNSTILE_SITE_KEY

.github/workflows/supabase-database.yml validates migrations locally on every PR/push that touches supabase/migrations/**, pushes them to staging on main, and supports an explicit production promotion via manual dispatch after staging succeeds.

Required GitHub repository secrets:

SUPABASE_PROJECT_REF is still accepted as a staging fallback for older edge-function deploy setups.

Edge functions proxy external services and keep server-managed secrets out of the browser. .github/workflows/supabase-functions.yml deploys to staging on main and can promote the same function set to production via manual dispatch.

• Edge functions reject requests from origins not listed in ALLOWED_ORIGINS.
• Repo sync tokens default to session-only storage and are never sent to GlossBoss servers — they go directly to the GitHub / GitLab API from the browser.
• Translation provider API keys can optionally be stored in the browser. On shared machines, saved keys should be removed after use.
• When cloud settings sync is enabled with credential sync, API keys are encrypted with AES-256-GCM using a per-user key derived server-side. The encryption key never lives in the database.
• Azure Translator endpoint URLs are validated against a domain allowlist to prevent SSRF.

If you find a security issue, please follow SECURITY.md instead of opening a public issue. See also /privacy/ and NOTICE.md.

See CONTRIBUTING.md.

AGPL-3.0-only — maintained by Toine Rademacher and Bjorn Lammers.