# Security policy

Offbeat stores Lidarr API keys and handles logins, and it is often exposed through a reverse proxy, so security reports matter a lot.

## Reporting a vulnerability

Please do not open a public issue.

- **Preferred:** use GitHub's [private vulnerability reporting](https://github.com/OffbeatOS/offbeat/security/advisories/new).
- **Or email** xwolv@proton.me.

Please confirm the problem yourself before reporting it; unverified reports generated by AI tools will be closed. Include what you found, how to reproduce it, the Offbeat version, and how it is deployed (Docker or bare metal, `BASE_URL`, reverse proxy). You will get an acknowledgement within a week. Once a fix is released, the advisory is published with credit to you unless you prefer otherwise.

## Supported versions

Offbeat is pre-1.0. Security fixes go into the latest release only, so please stay up to date.

## Scope

Especially interesting:

- Authentication or session bypass, including through `BASE_URL`, reverse-proxy headers, local network auto-login, or the Lidarr webhook
- Anything that exposes the Lidarr API key (or other stored credentials) to a browser, a log, or another host
- Making the image proxy, previews, or notifications fetch arbitrary URLs, or reach cloud metadata addresses
- Streaming reading a file outside the mapped music folders, or without the Stream permission
- Cross-site request forgery or scripting
- Offbeat writing outside its config directory or into the music library directly

Out of scope: problems in Lidarr, MusicBrainz, or other upstream services themselves, and attacks that need someone who is already an Offbeat admin.