Security

Minimal configuration

• keep listening on 127.0.0.1 if no remote access is required;
• configure AUTH_PASSWORD before opening the LAN;
• place an HTTPS reverse proxy in front of the exposed instance;
• restrict access via firewall, VPN, or address list;
• regularly update the image and yt-dlp.

Sensitive data

Protect cookies.txt, .session_secret, the SQLite database, private media, and backups in particular. Do not attach them to a bug report.

Model limitations

VidArch provides instance authentication, not full account and role management. It is intended for personal use or a small circle of trust.

To report a vulnerability, follow the security policy and avoid a public disclosure containing exploitable details.