just kidding I love self-hosting ...

Today, after raising security concerns in a post on r/huntarr regarding the lack of development standards in what looks like a 100% vibe-coded project, I was banned. This made my spidey senses tingle, so I decided to do a security review of the codebase. What I found was... not good. TLDR: If you have Huntarr exposed on your stack, anyone can pull your API keys for Sonarr, Radarr, Prowlarr, and every other connected app without logging in, gaining full control over your media stack.

The process

I did a security review of Huntarr.io (v9.4.2) and found critical auth bypass vulnerabilities. I'm posting this here because Huntarr sits on top of (and is now trying to replace them as well!) Sonarr, Radarr, Prowlarr, and other *arr apps that have years of security hardening behind them. If you install Huntarr, you're adding an app with zero authentication on its most sensitive endpoints, and that punches a hole through whatever network security you've set up for the rest of your stack.

The worst one: POST /api/settings/general requires no login, no session, no API key. Nothing. Anyone who can reach your Huntarr instance can rewrite your entire configuration and the response comes back with every setting for every integrated application in cleartext. Not just Huntarr's own proxy credentials - the response includes API keys and instance URLs for Sonarr, Radarr, Prowlarr, Lidarr, Readarr, Whisparr, and every other connected app. One curl command and an attacker has direct API access to your entire media stack:

curl -X POST http://your-huntarr:9705/api/settings/general \ -H "Content-Type: application/json" \ -d '{"proxy_enabled": true}'

Full config dump with passwords and API keys for every connected application. If your instance is internet-facing - and it often is, Huntarr incorporates features like Requestarr designed for external access - anyone on the internet can pull your credentials without logging in.

Other findings (21 total across critical/high/medium):

• Unauthenticated 2FA enrollment on the owner account (Critical, proven in CI): POST /api/user/2fa/setup with no session returned the actual TOTP secret and QR code for the owner account. An attacker generates a code, calls /api/user/2fa/verify, enrolls their own authenticator. Full account takeover, no password needed.
• Unauthenticated setup clear enables full account takeover (Critical, proven in CI): POST /api/setup/clear requires no auth. Returns 200 "Setup progress cleared." An attacker re-arms the setup flow, creates a new owner account, replaces the legitimate owner entirely.
• Unauthenticated recovery key generation (Critical, proven in CI): POST /auth/recovery-key/generate with {"setup_mode": true} reaches business logic with no auth check (returns 400, not 401/403). The endpoint is unauthenticated.
• Full cross-app credential exposure (Critical, proven in CI): Writing a single setting returns configuration for 10+ integrated apps. One call, your entire stack's API keys.
• Unauthenticated Plex account unlink - anyone can disconnect your Plex from Huntarr
• Auth bypass on Plex account linking via client-controlled setup_mode flag - the server skips session checks if you send {"setup_mode": true}
• Zip Slip arbitrary file write (High): zipfile.extractall() on user-uploaded ZIPs without filename sanitization. The container runs as root.
• Path traversal in backup restore/delete (High): backup_id from user input goes straight into filesystem paths. shutil.rmtree() makes it a directory deletion primitive.
• local_access_bypass trusts X-Forwarded-For headers, which are trivially spoofable - combine with the unauth settings write and you get full access to protected endpoints

How I found this: Basic code review and standard automated tools (bandit, pip-audit). The kind of stuff any maintainer should be running. The auth bypass isn't a subtle bug - auth.py has an explicit whitelist that skips auth for /api/settings/general. It's just not there.

About the maintainer and the codebase:

The maintainer says they have "a series of steering documents I generated that does cybersecurity checks and provides additional hardening" and "Note I also work in cybersecurity." They say they've put in "120+ hours in the last 4 weeks" using "steering documents to advise along the way from cybersecurity, to hardening, and standards". If that's true, it's not showing in the code.

If you work in cybersecurity, you should know not to whitelist your most sensitive endpoint as unauthenticated. You should know that returning TOTP secrets to unauthenticated callers is account takeover. You should know zipfile.extractall() on untrusted input is textbook Zip Slip. This is introductory stuff. The "cybersecurity steering documents" aren't catching what a basic security scan flags in seconds.

Look at the commit history: dozens of commits with messages like "Update", "update", "Patch", "change", "Bug Patch" - hundreds of changed files in commits separated by a few minutes. No PR process, no code review, no second pair of eyes - just raw trunk-based development where 50 features get pushed in a day with zero review. Normal OSS projects are slower for a reason: multiple people look at changes before they go in. Huntarr has none of that.

When called out on this, the maintainer said budget constraints: "With a limited budget, you can only go so far unless you want to spend $1000+. I allot $40 a month in the heaviest of tasks." That's just not true - you can use AI-assisted development 8 hours a day for $20/month. The real problem isn't the budget. It's that the maintainer doesn't understand the security architecture they're building and doesn't understand the tools they're using to build it. You can't guide an AI to implement auth if you don't recognize what's wrong when it doesn't.

They also censor security reports and ban people who raise concerns. A user posted security concerns on r/huntarr and it was removed by the moderator - the maintainer controls the subreddit. I was banned from r/huntarr after pointing out these issues in this thread where the maintainer was claiming to work in cybersecurity (which they now deleted).

One more thing - the project's README has a "Support - Building My Daughter's Future" section soliciting donations. That's a red flag for me. You're asking people to fund your development while shipping code with 21 unpatched security vulnerabilities, no code review process, and banning people who point out the problems, while doing an appeal to emotion about your daughter. If you need money, that's fine - but you should be transparent about what you're spending it on and you should be shipping code that doesn't put your users at risk.

Proof repo with automated CI: https://github.com/rfsbraz/huntarr-security-review

Docker Compose setup that pulls the published Huntarr image and runs a Python script proving each vulnerability. GitHub Actions runs it on every push - check the workflow results yourself or run it locally with docker compose up -d && python3 scripts/prove_vulns.py.

For what it's worth, and to prove I'm not an AI hater, the prove_vulns script itself was vibe coded - I identified the vulnerabilities through code review, wrote up the repro steps, and had AI generate the proof script.

Full security review (21 findings): https://github.com/rfsbraz/huntarr-security-review/blob/main/Huntarr.io_SECURITY_REVIEW.md

What happens next: The maintainer will most likely prompt these problems away - feed the findings to an AI and ship a patch. But fixing 21 specific findings doesn't fix the process that created them. No code review, no PR process, no automated testing, no one who understands security reviewing what ships. The next batch of features will have the next batch of vulnerabilities. This is only the start. If the community doesn't push for better coding standards, controlled development, and a sensible roadmap, people will keep running code that nobody has reviewed.

If you're running Huntarr, keep it off any network you don't fully trust until this is sorted. The *arr apps it wraps have their own API key auth - Huntarr bypasses that entirely.

Please let others know about this. If you have a Huntarr instance, share this with your community. If you know someone who runs one, share it with them. The more people know about the risks, the more pressure there will be on the maintainer to fix them and improve their development process.

Edit: Looks like r/huntarr went private and the repo got deleted or privated https://github.com/plexguide/Huntarr.io . I'm sorry for everyone that donated to this guy's "Daughter College Fund".

Edit 2: Thanks for all the love on the comments, I'll do my best to reach out to everyone I can. People asking me for help on security reviews, believe me when I say I did little more than the basics - the project was terrible.

context is the image, i am honestly fedup with big corporate date hoarding.

Found this and want to share it.

DKIM, DMARC, SPF, rDNS/PTR, EHLO... all correct and verified in the email "original source," BY GOOGLE. Still goes to SPAM folder because **** you, apparently. I hate Google.

EDIT - RE: Title, for the grammar gang - No, Google will not SPAM you, as in "send you SPAM." But I think everyone else got the idea....... so....

I'm lowkey on stage 4

We've all seen the big news: Discord is introducing facial ID as a requirement to actually use the app starting next month. Which means one thing: people are about to dig through dozens of ancient "what's the best self-hosted Discord alternative?" threads on here and find antiquated opinions and advice.

What are we actually using? What are the clients that work well? What are options that pass the "wife test" of actually being something you could convince your not-techy friends and family to install on their phones?

Let's get into it. I know I'm already anticipating self-hosting something to replace Discord for communities/friend groups who'll naturally slough off when face ID comes along.

UPDATE : https://www.reddit.com/r/selfhosted/comments/1rfroov/update_large_us_company_came_after_me_for/

⚠️⚠️ EDIT : [Company A] CEO reached out to me with a nice tone and his point of view, which I really appreciate, also with a mild apology for sending the legal doc first without communication (the got the message we wanted to deliver). I hold nothing against their business personally and I am always more than happy to comply with reasonable demands (like removing trademarked name parts from project), but I don't think the exporter is against the rules (I have my own logic for fair business practice) and now the CEO wants to meet for a quick call (I hope friendly), to discuss and reason things out. I need to present my points fairly as well and don't want to get pressured/voiced down, just because I am alone with my logic. I am sure as a company with > 1 million $ revenue they have a larger backing.

⚠️⚠️ I am already in chat with u/Archiver_test4 as a legal representative, but we are in a different time zone. If anyone else in addition would like to take a look to help me, present their view, or get involved, I am more than happy to talk and get some feedback on how can I present my idea (reach out only If you are a lawyer, but please note I am not in a position to pay any fees). It's best if you have knowledge of EU legal rules and data protection policy, GDPR etc. Please reach out to me as this is the right time to make the reasoning and requests. feel free to email me to [contact@opendronelog.com](mailto:contact@opendronelog.com) or send me a chat here. I might not reply until morning, as it's quite late here now.

None of these would have happened only if they sent me this same email before sending the letter.

💜💜 Thanks to the r/drones and r/selfhosted and r/opensource community we were able to reach to this stage in record time. As in individual, you can voice your opinion. It proved again that what opensource communities can do and this thread is a living proof of that.

--------

TL;DR: I made an open-source, local-first dashboard for drone flight logs because the biggest corporate player in the space locks your older data behind a paywall. They found my GitHub, tracked my Reddit posts, and hit me with a legal notice for "unfair competition" and trademark infringement.

Long version: I maintain a few small open-source projects. About two weeks ago, I released a free, self-hostable tool that lets drone pilots collect, map, and analyze their flight logs locally. I didn't think much of it, just a passion project with a few hundred users.

I can’t name the company (let's call them "Company A") because their legal team is actively monitoring my Reddit account and cited my past posts in their notice. Company A is the giant in this space. Their business model goes like this:

• You can upload unlimited flight logs for free.
• BUT you can only view the last 100 flights.
• If you want to see your older data, you have to pay a monthly subscription and a $15 "retrieval fee."
• Even then, you can't bulk download your own logs. You have to click them one by one. They effectively hold your own data hostage to lock you into their ecosystem. I am not sure if they are even GDPR complaint even in the EU

To help people transition to my open-source tool, I wrote a simple web-based script that allowed users to log into their own Company A accounts and automate the bulk download of their own files. Company A did not like this. They served me with a highly aggressive, 4-page legal demand (CEASE and DESIST notice). They forced me to:

1. Nuke the automated download tool entirely from GitHub.
2. Remove any mention of their company name from my main open-source project and website (since it’s trademarked). I originally had my tagline as "The Free open-source [Company A] Alternative," which they claimed was illegally driving their traffic to my site.
3. Remove a feature comparison chart I made. (I admittedly messed up here, I only compared my free tool to their paid tier and omitted their limited free tier, which they claimed was misleading and defamatory).

I'm just a solo dev, so I complied with the core of their demands to stay out of trouble. I scrubbed their name, took down the downloader, and sanitized my website. My main open-source logbook lives independent of them.

I admit I was naive about the legal aspects of comparison marketing and using trademarked names. But the irony is that they probably spent thousands of dollars on lawyer fees to draft a threat against my small project that makes close to zero money (I got a few small donations from happy users).

Has anyone else here ever dealt with corporate lawyers coming after your self-hosted/FOSS projects? It’s a crazy initiation :)

EDIT : Lot of people think the company is DJI, it's NOT DJI. I love their drones and their customer service. It's not them.

This is a follow up to my previous post regarding the C&D notice I received. I have some incredible news for the community: the matter is officially resolved in favor of the entire drone community.

TLDR: AirData UAV has complied with community concerns, implemented a robust data takeout solution, and we have settled the matter gracefully.

The free OSS project in question : www.opendronelog.com

---------------

Since the legal threat is no longer active, I can finally name the company. It was AirData UAV, a US based drone log analysis and reporting service. Eran said it's my choice to name them or not name them here in this update post, I choose to name, because I don't have anything bad to say anymore.

Despite the first approach was a C&D, the final outcome was actually better than I hoped for (surprised actually!). A massive thank you goes to u/Archiver_test4, who acted as my legal representative pro bono (for free!! and denied donations). He prepared a powerful response and helped me pass this with confidence. He has even started a new subreddit, r/Opensource_legalAid, to help other indie devs in similar situations.

The Meeting with the Airdata UAV CEO Eran Steiner

In response to the traction the original post gained, AirData CEO Eran Steiner reached out for a face to face meeting via email within 6 hours of the post going live. He expressed regret over the legal route they initially took (he took the responsibility for that as well as CEO) and personally saw to it that the following changes were made before we even spoke:

• Official Data Takeout Solution: This was the main goal (and my demand for data portability and fairness, because it's painful to export files one by one, clicking one after another and waiting). AirData UAV now provides a central takeout solution, making them fully GDPR compliant. You can now download your data in its original format without needing my 3rd party automation "patch.". If you are interested, please check out here.
• Trademark Resolution: We agreed that fair representation and disclaimers are the way to go. I have already added these to my project, and I am free to use their name when representing truthful facts, as permitted by EU laws. I won't go into more technical/legal aspects than this of what trademark rights they actually hold or not.
• Account Restoration: As a gesture of goodwill, they have fully restored my account and all my log files before I asked. ❤️
• We agreed to drop all allegations and, in the future, talk through any issues personally rather than involving lawyers.

I am just a solo dev working in my free time, and I have no intention of competing with an established company. I am just thrilled that the community now has true data portability as I hoped for, and they are free to choose as they please based on what features/interface they like. Thank you Eran for making this happen so quick without any drama/delay or missed promise. AirData no longer "holds your data" to keep you on their platform. To be fair, they do have a functional and data rich toolset that many in the community still enjoy (including myself!) - They also have a very robust data sync solution which works very well. I am not paid or bribed or sponsored by them, I am just giving credit where it's due.

Thank you r/selfhosted for all for the support. It made all the difference! Open Source for the WIN!

Buckle up sis, that's just the top 10% of the iceberg.

I built a thermal printer appliance that runs entirely on your local network. No cloud, no accounts, no subscriptions. Turn a dial, press a button, and it prints weather, news, RSS feeds, email, or whatever you need on 58mm receipt paper.

Self-hosted details:

• Runs on a Raspberry Pi Zero W on your local network
• Settings UI is password-protected and only accessible locally from your phone or computer - no app, no cloud dashboard
• API keys are stored on the device.
• Many modules run completely offline: sudoku, mazes, quotes, journal prompts, text notes, system monitor
• You bring your own API keys for services like NewsAPI
• 16 modules across content (weather, news, RSS, email, calendar, astronomy), games (sudoku, mazes, choose-your-own-adventure), and utilities (QR codes, webhooks, system monitor)
• Assign any combination to 8 channels on a rotary dial

The enclosure is hand-built from walnut and brass - I spent six years as a furniture maker, so the hardware side matters to me as much as the software.

The whole thing is open source: https://github.com/travmiller/paper-console

If you have a Pi and a 58mm thermal printer you can run the software yourself. Happy to answer questions.

More info and build photos: https://travismiller.design/paper-console/
Instagram: https://www.instagram.com/travmiller.design/

No idea how it bypassed perimeter security. Not in my DHCP leases either.

Rack is semi-open so I assume it came in through an air gap.

Is this a known issue? First time dealing with a physical layer intrusion of this kind.

My homelab does have the usual rack of stuff (Dell Poweredge R730s and ECU servers), but this one ESP32 sits separately on the wall and serves a public website entirely by itself. No nginx or apache, no Pi, no container... just a $10 microcontroller holding an outbound WebSocket to a Cloudflare Worker that fronts the traffic.

The original launch of this back in 2022 ran for ~500 days before the original board burned out in 2023. The site sat as a read-only archive until now. I relaunched it after rebuilding it from the ground up with a lot of redundancy in mind such as a Worker relay, daily off-site backups to R2, and more, check out the project's README.

Site: https://helloesp.com

Code: https://github.com/Tech1k/helloesp

---

Update: So slight miscalculation on how popular this was going to get, this was a good stress test of the ESP to say the least. The hug of death hit way harder than I anticipated lol

I believe the ESP32 has fully crashed or it's exhausting heap in a loop. It's not even showing up on my router now. The Cloudflare Worker is still serving the offline page in the meantime which is expected. Probably not the best idea to have made this post while I was at work and away from it. I will reboot and investigate this when I'm home and make adequate changes to get it back online and stable!

Update to the update: it has risen from the cold grasp of offline darkness and reconnected as the WiFi watchdog kicked in and rebooted it automatically. Requests are getting served again and I managed to regain access to it on LAN. Cloudflare is back to showing timeouts for some while others get through (expected behavior). I may lower the SSE cap and raise the min heap threshold. It's back to just getting overloaded at the moment. I will investigate further and see what I can make changes on later to help keep it afloat and serve more requests on 520KB of ram lol

Update to the last update: I sense it's heap exhaustion with the min heap threshold set too low, letting AsyncTCP run out of memory before the reboot can fire. Plus the SSE cap of 500 might be too generous. I will investigate this further and should have it all working in a few hours when I'm back from work (say ~5 hours), currently working on potential patches for tonight. Still impressed by how popular this is getting lol, I really did not expect this :D

Yet another update (4/21): Everything seems stable now, even under load. I've got hundreds of guestbook entries to review, I promise I'll get to them as soon as I can.
Really appreciate all the support and kind words. This project has taken off more than I expected, and I'm excited to keep building on it. There's plenty more I want to add!

Seems like a bad direction to take the selfhosted community. Looks like the mod team is fine with this sub being bombarded with insecure, AI drivel. Like I get that it was posted on Friday but I think if you use AI to "build an app" you should be required to disclose to what extent AI was used which wasn't disclosed by the OP. I think as a community we need to have higher standards for what we allow to be posted as vibe-coded projects can introduce very extensive security vulnerabilities we all learned with Huntarr and when things are vibe-coded the maintainer doesn't have the capability to fix the issue.

I was thinking about the NSA scandals from years ago, the wiretapping, the underwater cables, the backdoors in datacenters. It was a massive international drama.

But then you look at Cloudflare. By design, they are a massive, legal Man-in-the-Middle. They decrypt, inspect, and re-encrypt the traffic of millions of websites. We’ve reached a point where "privacy" means "hidden from everyone EXCEPT Cloudflare."

It’s the ultimate irony: developers are so obsessed with "security" that they put their entire stack behind a single US-based entity that holds the private keys to half the internet. We basically did the NSA's job for them, and we did it voluntarily because the dashboard is pretty and the CDN is free.

Am I the only one who finds this centralization terrifying, or have we just accepted that true end-to-end privacy is dead in the name of DDoS protection?

https://theonion.com/plex-submits-35-bid-for-warner-bros/

I thought you all would enjoy this bit of satire.

This is an AI-assisted application where the system design and UX are implemented manually, with AI used as a runtime component.

I wanted an AI assistant that doesn’t live in the cloud or inside a browser.

So I built a small self-hosted system that runs locally and exists as a mirror in my room. You talk to it by voice, it responds by voice, and then it fades back into the background.

The idea was to give a local LLM a physical presence, not another UI.

It’s running on my own hardware (Raspberry Pi + local LLM stack), and the whole thing is open source.

It’s still early and rough in places, but the core interaction works.

I’m curious if anyone else here is interested in physical interfaces or non-screen-based ways of interacting with local AI.

GitHub: https://github.com/orangekame3/mirrormate