What the software does to protect an installation, its viewers and its data, as implemented today. This is a description of features, not a certification or a guarantee; the operator secures the servers the software runs on.
Self-hosted by design
Every component runs on servers the operator controls: the panel, the subscriber API, the worker, the origin and the nodes. The publisher receives nothing from an installation except what the operator turns on (the update check sends the version only; a TMDB lookup sends the title searched).
Accounts and access to the panel
Panel accounts have roles and permission groups; passwords are stored as bcrypt hashes; time-based one-time passwords (TOTP) are available and can be required for administrators; sign-in is protected against brute force; optional reCAPTCHA or Turnstile on the sign-in page; every change is written to an audit log with the actor and the address.
Secrets and data at rest
SSH credentials of servers, API keys of third parties and similar secrets are sealed with a key derived from the installation's secret before they are stored; Admin API keys are stored as hashes and shown once. Line (viewer) passwords are stored in clear because player applications must be told them; the operator is responsible for the database's protection.
Playback protection
Playback links are signed with HMAC-SHA256 and expire; they can be bound to the viewer's address; each line has a connection limit; rules by country, by ISP or by address can block or allow viewers; repeated failed sign-ins are blocked automatically. There is no DRM.
Backups and resilience
Scheduled database dumps, encrypted with a passphrase the operator holds, with a restore check on every dump and an optional off-site copy to S3-compatible storage; maintenance mode; nodes fall back to the origin; jobs run with leases and deadlines.
Visibility
Prometheus metrics and health endpoints for the API, the panel and the worker; connection and traffic views; alerts by e-mail, Telegram or signed webhook; a cluster log of every change to the servers.
Reporting a vulnerability
Write to [email protected] with the subject "Security" and a description that lets the issue be reproduced. Please allow time for a fix before publishing details. The publisher does not run a bug bounty programme.