HolyArrs runs on your server, next to your media and your download clients, so security bugs get handled first.

Please don't open a public issue for a security problem.

Report it privately instead:

1. Use Report a vulnerability on the Security tab of the affected HolyArrs repo, or
2. Email support@holyarrs.com with "Security" in the subject.

Include what you found, how to reproduce it, and which version you were on. A proof of concept helps a lot.

• I'll confirm I got your report within 3 days.
• I'll keep you posted while I work on a fix.
• Once a fix ships, I'll credit you in the release notes, unless you'd rather stay anonymous.

Security fixes go into the latest release. Please update before reporting, in case it's already fixed.