Please report vulnerabilities privately through GitHub's Security → Report a vulnerability flow. Do not open a public issue for an unpatched vulnerability.

Security fixes are applied to the latest release line and main. This project does not currently promise security maintenance for older container tags. Avoid the rolling latest tag when your deployment requires controlled updates; pin a version and review new releases before upgrading.

The bridge requires a Jellyfin administrator API key because Jellyfin restricts item metadata and user policy updates to administrators. Keep the service on a trusted network, use different long random values for WEBHOOK_TOKEN and ADMIN_TOKEN, and expose only the webhook endpoint through a TLS reverse proxy if Seerr is on another network. ADMIN_TOKEN protects grant inspection, dry runs, group management, revocation, reconciliation, and metrics. It falls back to WEBHOOK_TOKEN only for backward compatibility.

Browser administration accepts only enabled Jellyfin administrator accounts. Credentials are sent directly to the configured Jellyfin server, are never stored or logged, and the temporary Jellyfin access token is logged out immediately after authentication. JellyPass then uses a random in-memory session. Session cookies are HttpOnly and SameSite=Strict; when the request arrives through an HTTPS reverse proxy they are Secure and named with the __Host- prefix, so sibling hosts under the same site cannot set them. Each session's administrator is re-read from Jellyfin every five minutes, and a deleted, demoted or disabled administrator's session ends. State-changing requests made with the session cookie, and sign-ins, must come from the admin origin (Sec-Fetch-Site: same-origin, or an Origin matching Host; X-Forwarded-Host is never trusted), checked before the session is, and request bodies must be declared as JSON, because SameSite=Strict does not stop requests from sibling hosts such as household hosts or Seerr. Failed web logins all get the same answer after at least one second, and are rate-limited per client address (the real client behind a trusted proxy) and per name from one address, with the same fixed 429 after the same second; failures for a name from many addresses only slow its sign-ins down (up to five seconds) and never lock its owner out. The admin URL itself is not gated; put it behind Cloudflare Access, a VPN or an allowlist. The service never logs passwords, Jellyfin access tokens, the Jellyfin API key, or webhook tokens. Its state file contains Jellyfin user identifiers and a catalog of media names and identifiers, and is created with owner-only permissions where the host filesystem supports them.