Please do not open a public issue for security vulnerabilities.

Report privately through one of:

• GitHub private advisory — open a draft advisory at https://github.com/diegopeixoto/posterpilot/security/advisories/new (Security → Advisories → Report a vulnerability).
• Email — diego@aquarela.io

Include a description, reproduction steps, affected version/commit, and impact.

You can expect an acknowledgement within a few days. Once the issue is confirmed and a fix is available, we will coordinate disclosure and credit you (unless you prefer to remain anonymous).

PosterPilot is a self-hosted application that holds credentials for your media server (Plex/Jellyfin/Emby) and TMDB. Reports affecting the confidentiality of those credentials, the SQLite database, or remote code execution are especially important.

Security fixes target the latest released version on the main branch.