Security

LatestArr holds credentials for your media servers and your mail server, and may face the internet. It’s built with that in mind, but it’s also pre-1.0 and written by AI with a human reviewing every change. Read How it’s built and judge for yourself.

What’s protected, and how

Credentials at rest. Source API keys and passwords, SMTP credentials, and the alert webhook URL are encrypted with AES-256-GCM using your ENCRYPTION_KEY. The encryption is authenticated, so tampering or the wrong key is detected rather than producing garbage. The OIDC client secret is read from the environment, so protect your .env file.

Nothing leaks into emails. Posters are downloaded by LatestArr and embedded, so internal addresses and tokens never appear in a sent email.

Accounts and sessions

• Passwords are hashed with Argon2 and need at least 12 characters.
• Sessions are server-side. The browser holds a random token; only its hash is stored. Sessions last 30 days, and the cookie is HttpOnly, SameSite=Lax, and Secure over HTTPS.
• Deactivating a user or resetting their password signs them out everywhere.
• Someone given a temporary password can do nothing but choose a new one.
• SSO via OIDC, with PKCE. See SSO with OIDC.

Requests

• Cross-site request protection: state-changing requests from another origin are refused.
• Rate limiting: 300 requests a minute overall, and 10 a minute for sign-in.
• Security headers, including a strict Content Security Policy.
• Input validation on every route, and every route except sign-in, first-run setup, and the version and health checks requires a signed-in user. A test checks this for every route.
• Server errors are logged in full but never sent to the browser. Passwords, API keys, and tokens are never logged.
• Requests to sources time out after 30 seconds and images are capped at 20 MB, so a broken or hostile source can’t hang a send.

The container runs as an unprivileged user, not root. New in 0.11

The project

• CI runs lint, typecheck, build, tests, and accessibility checks on every change.
• Dependabot and CodeQL run continuously.

Exposing it to the internet

LatestArr is built to be reachable from the internet, but a few things are up to you:

• Always use HTTPS, through a reverse proxy with TRUST_PROXY=true, so the session cookie is marked Secure. Never publish port 3000 directly.
• Use strong passwords, or SSO. Failed sign-ins show on the Logs page.
• Keep ENCRYPTION_KEY secret and backed up.
• Keep up to date. Security fixes only go into the latest release.
• Only give accounts to people you trust with your network. Sources, SMTP servers, and webhooks usually live on your own network, so any signed-in user can point LatestArr at an internal address, and Test connection reports whether it answered. That’s intended, and every user is a full admin.

Reporting a vulnerability

Don’t open a public issue. Report it privately through GitHub Security Advisories . SECURITY.md has the details and an alternative contact.

Until 1.0, security fixes go into the latest release only, which is one more reason to keep up to date.

Help review it

A second pair of eyes on security, credential handling, and email handling is one of the most useful things you can offer. See Contributing.