Only the latest main branch is supported for security and privacy fixes.

Do not post any of the following publicly:

• Apple ID email address.
• Apple ID password.
• Media User Token.
• Authorization token.
• .credentials.
• config.yaml.
• Unredacted diagnostics bundles.
• Private webhook URLs.

Diagnostics generated by the Web UI attempt to redact sensitive fields, but you should still review any file before sharing it.

Saved Apple Music credentials are stored locally in .credentials with basic obfuscation, not strong encryption.

Recommended practices:

• Use a dedicated Apple Music account instead of your primary personal Apple ID.
• Delete saved credentials from the Web UI if you no longer need auto-login.
• Remove .credentials manually if needed.
• Never commit .credentials to Git.

The Web UI has no authentication. By default it binds to 127.0.0.1 (localhost only), so it is not reachable from other machines.

Do not expose the Web UI directly to the public internet.

Only enable LAN access if you trust your network:

sudo FLASK_HOST=0.0.0.0 python3 main.py

If remote access is needed, use a trusted VPN or SSH tunnel instead of binding to all interfaces.

If you publish this repository, configure GitHub private vulnerability reporting or add a private contact email here.

Please do not open public issues containing credentials, tokens, private logs, or exploit details.