Hi!

First of all, I'm really sorry for adding a widget to your dashboard for this -- I couldn't find a way to email you and this felt important.

I was looking up french-language providers for bazarr and your bazarr instance's configuration page showed up on the first page of duckduckgo for the search term "bazarr french subtitle provider" as the fourth item:

I clicked on the first few search results and was surprised to see your bazarr settings pop up when I got to that tab. I would recommend that you enable authentication for bazarr like you seem to have for sonarr and radarr (the option for this is in settings -> general -> security -> authentication).

The amount of damage someone can do with only access to bazarr is rather minor, but having access to your bazarr instance also gives access to your api keys for sonarr and radarr, which could be used by a malicious actor to send commands to sonarr/bazarr (e.g. a dos attack to fill up your disk space, pull your api token for qbittorent, etc.), which would not be a good time. I also recommend resetting your api keys after you enable authentication in case somebody else came along and saved them when your bazarr instance was publically accessible.

That should be enough to cover your sonarr/radarr/bazarr stack, although I poked around a bit to try and find a way to contact you (kudos for getting the private option for your domain's whois records) and I noticed a few other things that you might want to secure. Notably, you probably don't want random people to be editing your dashboard.

I'm not sure how your server/infrastructure is set up, but assuming that you have a reverse proxy handling your https requests I would recommend also setting up basic auth for your homarr and dash instances, along with anything else that you can't natively enable authentication for.

Here's a tutorial for if you're using nginx: https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/

And here's one for apache: https://www.howtogeek.com/devops/how-to-setup-basic-http-authentication-on-apache/

Otherwise, it might be good to do a quick double-check that you don't have anything else publically accessible that you don't want to be. I was really only trying to find a way to contact you to let you know that your bazarr instance is publically available so this isn't an exhaustive audit by any means.

Again, sorry for intruding on your dashboard with this notice. Your setup looks really nice overall!

I hope you have a good day!

Cheers 🍻