Never commit these files or directories:

• .env
• data/
• database files such as *.db, *.sqlite, *.sqlite3
• logs
• private screenshots or task records

The following values are sensitive:

• QAS_TOKEN
• TMDB_API_KEY
• PANSOU_TOKEN
• P115_COOKIE and 115 Open access/refresh tokens
• OPENLIST_TOKEN
• Telegram bot tokens and enterprise-WeChat secrets, callback tokens, and keys
• exported MediaIndex configuration backups, because they intentionally contain service credentials
• AUTH_SECRET, if you choose to set it manually
• data/auth_secret, if it is generated by the application
• NAS usernames, paths, hostnames, and private reverse-proxy domains

If any secret is accidentally committed or published, rotate it immediately.

• Change the default password before first use. MEDIA_PASS=admin is refused by the application.
• Do not expose the service directly to the public internet.
• Prefer VPN, LAN-only deployment, or a reverse proxy with authentication.
• Restrict access to QAS and PanSou endpoints.
• Back up your database before upgrades.

The developer support API is disabled by default. It accepts only separately generated, short-lived, read-only bearer tokens; stores only their SHA-256 digests; rate-limits reads; disables response caching; and exposes only redacted diagnostic events or one task timeline. It cannot read configuration or raw logs, execute commands, or mutate business data. Disabling the option revokes every active support token. Expose it only through HTTPS, and never share administrator passwords, provider cookies, or permanent service tokens for support.

Do not include tokens, cookies, private links, or personal NAS paths in public issues. Redact all sensitive values before sharing logs.