Do not open a public issue for a vulnerability involving authentication, sessions, credential exposure, or remote code execution. Use GitHub's private security advisory feature for this repository.

Include reproduction steps, affected versions, expected impact, and any proposed mitigation. Do not include real Spotify credentials or session cookies.

• Keep the /data volume private. It contains the generated session secret and the public Spotify Client ID configuration.
• If overriding SESSION_SECRET, use a unique random value of at least 32 bytes.
• Use HTTPS for every non-loopback deployment.
• Set TRUST_PROXY=1 only behind a trusted reverse proxy that overwrites forwarded headers.
• Keep the container image and NAS platform updated.
• Do not publish .env, logs containing tokens, or browser session data.