Skip to main content

Security

What Reaper actually enforces, and where the edges are.

What an API key can do​

You'll find your instance API key in Settings, General. It's narrow, and even narrower on writes than on reads.

It can never:

  • Run a reap. You'll need a signed-in browser for the route that deletes.
  • Turn deletion on.
  • Read or change a service connection, the Plex link, or a stored credential.
  • Change any sign-in setting, the schedule, or notifications.
  • Download a backup, read the logs, or see who watched what.

It can:

  • Read most of the app, including the review queue with real titles, sizes, and verdicts.
  • Run a scan, create a plan, and perform a dry-run.
  • Update the policy, or adjust your run limits and grace.

What a reap requires​

Every one of these, together:

  1. A signed-in browser session.

    An API key is refused on this route. So is a request without the app's own header, which a page on another site cannot set.

  2. Deletion armed on the host.

    A property of the machine, set in Policy, Deletion behind your admin password.

  3. A phrase you type that matches the plan.

    Recomputed on the server against that exact set of files. A plan that changed underneath you stops matching.

  4. Every interlock, again, per file.

    Manifest re-check, the caps, the test file, the streaming veto, and the played-since-approval check. See How a delete is kept safe.

The connection Reaper's requests travel through refuses any change unless deletion is armed and the delete was written down first.

Credentials at rest​

Reaper encrypts your Sonarr, Radarr, Tautulli and Seerr keys, your Plex token, the Discord webhook and its own API key before storing them.

  • The encryption key is stretched with scrypt and a per-install salt.
  • Key files are created readable only by their owner from the instant they exist.
  • Unreadable key material stops the app from starting instead of regenerating over your data.
  • The API reports whether a credential is set but never returns the value.
  • Logs are scrubbed, including secrets hidden in a query string or a webhook URL.

The encryption key covers backup and rotation.

Sign-in​

  • Sessions use random tokens that are hashed before storage, so a copied database won't give out any live sessions.
  • Your session lasts 30 days from sign-in. Using the app won't extend it.
  • Signing out revokes your session. Changing your password evicts every other session.
  • Repeated failures trigger a back off keyed on both the address and the account name. This same throttle covers arming and a restore.

The sharp edges​

  • The session cookie is only marked secure when Reaper can see that the connection is HTTPS. If you terminate TLS at a proxy without telling Reaper to trust it, the cookie stays unmarked. Turn on reverse proxy trust and list the proxy.
  • Forwarded headers are ignored until you turn on reverse proxy trust. Every client address in your log will show as your proxy until you do this.
  • REAPER_DESTRUCTIVE_ACTIONS_ENABLED=false is not a permanent lock. It only seeds the first run. The stored value in the app wins once you've set the switch.
  • The backup download needs only a signed-in session. It includes the database and the key used to decrypt it unless you provide that key from the environment. You'll need your password to restore a backup, but you don't need it to download one.
  • The API reference page can send real writes. When you're signed in, the try-it-out button acts as you. This includes unlinking Plex or rotating the API key.
  • The app drops to an unprivileged user, unless you ask otherwise. It starts as root just to take ownership of its data folder. Set PUID=0 to keep it as root.