If you discover a security vulnerability in shelfr, please report it responsibly:

1. Do NOT open a public GitHub issue for security vulnerabilities
2. Email the maintainers directly or use GitHub's private vulnerability reporting feature
3. Include as much detail as possible:
   • Description of the vulnerability
   • Steps to reproduce
   • Potential impact
   • Suggested fix (if any)

We will acknowledge receipt within 48 hours and provide a more detailed response within 7 days.

shelfr handles sensitive information that should never be committed to version control:

1. Never commit .env files - They are gitignored by default
2. Use environment variables in production/containerized deployments
3. Restrict file permissions on config files: chmod 600 config/.env
4. Review config.yaml before committing - ensure no secrets are embedded
5. Use separate credentials for shelfr vs your main accounts when possible

For Unraid/Linux deployments:

# Restrict access to secrets
chmod 600 config/.env
chmod 600 config/config.yaml

# Ensure proper ownership
chown $USER:$USER config/.env config/config.yaml

If running in Docker:

• Mount config files as read-only when possible
• Use Docker secrets for sensitive values
• Don't expose qBittorrent WebUI to the internet without authentication

We regularly update dependencies to patch known vulnerabilities. Run:

pip install --upgrade -e ".[dev]"

To check for known vulnerabilities in dependencies:

pip install pip-audit
pip-audit