# Security policy

## Supported versions

Security fixes are provided for the latest stable release.

## Reporting a vulnerability

Do not open a public issue for tokens, credentials, path disclosure, traversal, command
execution, authentication bypass, or another exploitable weakness. Use GitHub private
vulnerability reporting for the repository. Maintainers should acknowledge a report
within seven days and coordinate a fix and disclosure.

Never include a Plex token, SMTP password, webhook secret, user password, database,
diagnostic encryption key, or unredacted media path in a report.

## Threat model

### Assets

- Media availability and confidentiality
- `/config` database, encryption key, credentials, user accounts, and scan history
- LAN access to the API and UI
- Server I/O capacity while Plex is active

### Trust boundaries

- Browser to HTTP API
- Container to explicitly mounted host directories
- Container to Plex and notification endpoints
- Process to `ffprobe`
- Application to SQLite under `/config`

### Primary threats and controls

- **Filesystem modification:** no write operations exist for analyzed roots; templates
  mount them read-only, use `no-new-privileges`, and do not request privileged mode.
- **Path traversal:** API paths are resolved beneath a configured root and parent
  segments are rejected.
- **Command injection:** `ffprobe` uses an argument array without a shell. No arbitrary
  command endpoint exists.
- **Secret leakage:** secrets are encrypted with an installation-local key, redacted
  from API/diagnostics/logs, and never placed in notification text.
- **Double counting and unsafe conclusions:** root overlap is rejected by default;
  hardlinks are identified by device/inode and excluded from reclaimable estimates.
- **Resource exhaustion:** bounded probe concurrency, timeouts, streaming traversal,
  batched writes, pagination, and conservative defaults.
- **Cross-site attacks:** strict response headers, same-origin API, constrained CORS,
  output escaping, and no runtime CDN. Deployments exposed beyond a trusted LAN must
  use authenticated TLS.
- **Database loss:** WAL, short transactions, successful-scan-only stale cleanup,
  integrity guidance, and full `/config` backups.

### Out of scope

An attacker with root access to the Unraid host, write access to `/config`, control of
the container runtime, or the ability to replace the application image is outside the
application trust boundary.