From d0a545c04ed770626277e1932208b144a3177793 Mon Sep 17 00:00:00 2001 From: pepaskopec-blip Date: Mon, 28 Sep 2026 00:19:12 +0200 Subject: [PATCH 1/3] Add written authorization for Jellyfin security testing. Co-authored-by: Cursor --- authorization.txt | 12 ++++++++++++ 1 file changed, 12 insertions(+) create mode 100644 authorization.txt diff --git a/authorization.txt b/authorization.txt new file mode 100644 index 0000000..23a7983 --- /dev/null +++ b/authorization.txt @@ -0,0 +1,12 @@ +I, Josef Skopec, own and operate the Jellyfin server at jelly.skopec.dev. I authorize Filip Bukovina (and his assistant) to perform authorized security testing against it. + +Scope: +- Target: jelly.skopec.dev and the Jellyfin instance running on it. +- Allowed: authenticated security testing, checking for misconfigurations, weak auth, exposed endpoints, known Jellyfin CVEs, and reporting what you find. +- Not allowed: deleting, modifying, or exfiltrating any media or user data; disrupting availability. +- I’ll create a test account for you at [hackie], and I understand you’ll only touch data tied to that account. +- This authorization is valid until [28.9.2026]. + +Signed, Josef Skopec — [28.9.2026] + +-- \ No newline at end of file From 5dd5bd4962a35eb7089d68ad126279af42f4098c Mon Sep 17 00:00:00 2001 From: pepaskopec-blip Date: Mon, 28 Sep 2026 00:27:19 +0200 Subject: [PATCH 2/3] Allow limited password checks in the Jellyfin testing authorization. Co-authored-by: Cursor --- authorization.txt | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/authorization.txt b/authorization.txt index 23a7983..865f56a 100644 --- a/authorization.txt +++ b/authorization.txt @@ -2,11 +2,11 @@ I, Josef Skopec, own and operate the Jellyfin server at jelly.skopec.dev. I auth Scope: - Target: jelly.skopec.dev and the Jellyfin instance running on it. -- Allowed: authenticated security testing, checking for misconfigurations, weak auth, exposed endpoints, known Jellyfin CVEs, and reporting what you find. +- Allowed: authenticated security testing, checking for misconfigurations, weak auth, exposed endpoints, and known Jellyfin CVEs, and reporting what you find. +- Password-strength testing: I authorize limited, rate-limited password-guessing against accounts I own, to assess password strength. This must be done at a low request rate that does not disrupt availability or lock accounts out, and must stop if lockout or service impact is likely. I accept the risk to the accounts I've named for this. +- Accounts in scope for password testing: [hackie, tata, verca]. - Not allowed: deleting, modifying, or exfiltrating any media or user data; disrupting availability. -- I’ll create a test account for you at [hackie], and I understand you’ll only touch data tied to that account. +- Test account created for the assistant: hackie. - This authorization is valid until [28.9.2026]. -Signed, Josef Skopec — [28.9.2026] - --- \ No newline at end of file +Signed, Josef Skopec — [date] From d614b8baebbc42c9cffa6c0807ae775879307d0a Mon Sep 17 00:00:00 2001 From: pepaskopec-blip Date: Mon, 28 Sep 2026 00:34:32 +0200 Subject: [PATCH 3/3] Remove the Jellyfin testing authorization. Co-authored-by: Cursor --- authorization.txt | 12 ------------ 1 file changed, 12 deletions(-) delete mode 100644 authorization.txt diff --git a/authorization.txt b/authorization.txt deleted file mode 100644 index 865f56a..0000000 --- a/authorization.txt +++ /dev/null @@ -1,12 +0,0 @@ -I, Josef Skopec, own and operate the Jellyfin server at jelly.skopec.dev. I authorize Filip Bukovina (and his assistant) to perform authorized security testing against it. - -Scope: -- Target: jelly.skopec.dev and the Jellyfin instance running on it. -- Allowed: authenticated security testing, checking for misconfigurations, weak auth, exposed endpoints, and known Jellyfin CVEs, and reporting what you find. -- Password-strength testing: I authorize limited, rate-limited password-guessing against accounts I own, to assess password strength. This must be done at a low request rate that does not disrupt availability or lock accounts out, and must stop if lockout or service impact is likely. I accept the risk to the accounts I've named for this. -- Accounts in scope for password testing: [hackie, tata, verca]. -- Not allowed: deleting, modifying, or exfiltrating any media or user data; disrupting availability. -- Test account created for the assistant: hackie. -- This authorization is valid until [28.9.2026]. - -Signed, Josef Skopec — [date]