Security and secret handling

Keep the product private

Omakase Plus is private preview software. Bind the application and bundled Plex to loopback until a trusted LAN route, firewall, authentication, and HTTPS are ready.

The public Omakase recommendation surface must not contain Plus routes, Plus credentials, or private deployment code.

Configure exposure as one change

When moving beyond loopback, configure together:

• the external HTTPS base URL;
• allowed hostnames;
• Secure session cookies;
• the reverse proxy route;
• firewall scope;
• owner authentication.

Do not expose the application over plain HTTP to an untrusted network.

Secret storage

Keep secret values in a mode 0600 secret environment file or a dedicated secret manager. Secret material includes:

• the Omakase Plus master key;
• login credentials;
• AniList OAuth client secret and access token;
• Plex token;
• Real-Debrid credentials;
• optional catalog and qBittorrent credentials.

Do not pass secrets as CLI arguments, put them in Git, print them in health endpoints, or include them in screenshots.

The master key protects encrypted integration values. Back it up independently. Losing it can make encrypted stored credentials unrecoverable.

Container boundary

• Do not mount the Docker socket into Omakase.
• Treat the host docker group as root-equivalent.
• Mount the import root read-only.
• Make the managed library the only media write path.
• Keep application data and Plex configuration on filesystems with correct locking.
• Never expose broad host roots.
• Give qBittorrent no independent host ports.

Support and logs

Use the privacy-redacted support-bundle command. Its default output excludes databases, credentials, magnets, tracker URLs, full filenames, private paths, and watch history.

Review any archive before sharing it. Browser developer tools can reveal authorization headers and private URLs even when the page itself looks safe.

Updates

Deploy only a clean, exact private revision. Confirm the source revision, built image revision, database migration state, and health response agree.

Back up before mutation and preserve a rollback receipt. Do not copy arbitrary files into a running container as an update mechanism.

Security limitations

Omakase reduces operational risk; it does not make a public multi-tenant media service safe by default. Strong isolation, public signup, billing, and untrusted-user hosting are outside the current release posture.