The author's forensic writeup demonstrates how a single leaked API key gave an attacker weeks of unaudited admin access to his Prowlarr instance. He argues the *arr suite's authorization model — where a valid API key equals full admin with no scopes, no audit prompts, and no second factor — is incompatible with the reality that these services routinely get exposed via Cloudflare Tunnels and reverse proxies.
The author traces the root cause to an API key he had committed to a public GitHub gist three years earlier during a docker-compose experiment, then 'removed' in a later commit. He emphasizes that git history preserves everything and that the self-hoster habit of pasting configs into gists and repos creates a long-tail attack surface that outlives the original mistake by years.
Rather than attempting to escalate to RCE or exfiltrate data, the attacker spent weeks subtly manipulating indexer priorities and injecting bad releases to make Sonarr appear broken. The author argues this low-stakes griefing threat model is widespread in the torrent ecosystem and goes undetected precisely because defenders are looking for loud compromise signals, not silent config drift.
The editorial frames this incident as representative of a much larger problem: LinuxServer.io's Sonarr image alone has over a billion Docker pulls, and the full *arr ecosystem plus Jellyfin and qBittorrent compounds that footprint. This makes the consumer self-hosted stack one of the largest unaudited server fleets on the internet, where a single class of auth flaw affects millions of exposed instances.
A developer running the standard self-hosted media stack — Sonarr for TV automation, Prowlarr as the indexer aggregator, qBittorrent for the actual downloads — noticed his queue was behaving strangely. Shows that should have grabbed on release night were sitting idle. Releases that *did* grab were the wrong cut, the wrong group, sometimes the wrong episode entirely. The usual self-hoster response kicked in: restart the container, bump the indexer priorities, blame the tracker.
It wasn't the tracker. Someone had been quietly reaching into his Prowlarr instance and editing indexer configs, flipping priorities, and injecting bad results — for weeks — because the admin UI was reachable from the public internet with an API key that had leaked into a GitHub gist three years earlier. The author's writeup, which hit the Hacker News front page at 280 points, walks through the forensic trail: unexpected config diffs in the SQLite DB, a login IP from a country he's never visited, and a Prowlarr audit log showing requests he never made. The attacker wasn't trying to pwn the box. They were griefing his download queue — swapping out release groups, blacklisting good indexers, and generally making Sonarr look broken.
The root cause stack is depressingly ordinary. A Cloudflare Tunnel exposed the Prowlarr UI on a subdomain he'd forgotten about. The API key in the config file had been committed to a public repo during an early docker-compose experiment, then "removed" in a later commit — which, as every security person knows, removes nothing. And Prowlarr, like most of the *arr suite, treats a valid API key as full admin: no scopes, no audit prompts, no second factor.
The self-hosted media stack is one of the largest, least-audited server fleets on the consumer internet. LinuxServer.io's Sonarr image alone has over a billion Docker pulls. Multiply that by Radarr, Prowlarr, Lidarr, Readarr, Bazarr, Overseerr, Jellyfin, qBittorrent, and you have a surface area that rivals a mid-tier SaaS vendor — except every instance is run by one person, usually at home, usually behind "security by obscurity on a weird subdomain."
The *arr apps were designed in an era when "self-hosted" meant "on your LAN," and the auth model never caught up to the Cloudflare Tunnel era. Form-based login was bolted on as an option, not a default. API keys are long-lived, unscoped, and printed in plaintext in the UI. There is no built-in rate limiting on the admin endpoints. There is no notification when a config changes. If you're coming from a corporate stack where every internal tool has SSO, audit logs, and a break-glass flow, the *arr suite is a time machine back to 2011.
The HN comments split roughly three ways, and all three are worth taking seriously. The first camp — mostly veteran homelabbers — argued that nothing here is a vulnerability. The author exposed an admin panel to the internet and leaked the key. That's not a bug, that's using the tool wrong. The second camp pushed back: the fact that "using the tool wrong" is the default happy path for every tutorial on YouTube is itself the bug. The third camp, which is the one worth sitting with, pointed out that the attacker's behavior — subtle, long-running, intentionally confusing — is exactly what you'd expect from someone who wanted to *remain* in the system. Griefing a Sonarr queue is a plausible cover for using the same box as a jumpbox, a seedbox for someone else's content, or a staging ground for a wider sweep across the subdomain's reverse-proxied siblings.
The tracker angle is where this stops being a hobbyist story. Private trackers maintain detailed ratio and client data on every member. A tracker operator — or anyone who's compromised one, which has happened repeatedly over the past decade — can map announce IPs to usernames to passkeys. Combine that with a leaked API key and you have targeted griefing at scale. The author doesn't name the tracker, but the HN thread includes several reports from users on specific private trackers describing identical symptoms over the last six months. Whether that's a coordinated campaign, a bored admin, or shared tooling making the rounds in a Telegram channel, nobody knows. The fact that we don't know is the point.
If you run any of the *arr apps, three concrete changes are worth making this week, in roughly this order.
First, stop exposing admin UIs to the public internet, full stop — put them behind Cloudflare Access, Tailscale, or a WireGuard tunnel, not just a Cloudflare Tunnel with no auth policy in front of it. A Cloudflare Tunnel without an Access policy is a public URL with a fancier DNS record. Access adds a free Zero Trust login layer (Google, GitHub, one-time PIN) that sits in front of the tunnel. Setup is ten minutes. The author's postmortem explicitly calls this out as the fix he should have deployed on day one.
Second, rotate every API key in your stack and then audit where they live. Prowlarr, Sonarr, Radarr, and Overseerr all let you regenerate keys from the UI, but almost nobody does it after the initial setup. If you've ever pasted a `docker-compose.yml` into a gist, a Discord, or a Reddit post for troubleshooting help, assume the key in it is compromised. Grep your git history — `git log -p -S 'ApiKey'` is a good start — and rotate anything that shows up.
Third, turn on the notification connectors you've been ignoring. Sonarr and Prowlarr both support webhook notifications on config changes and auth events. Point them at a Discord channel, a Pushover, or an ntfy topic. This is the lowest-effort intrusion detection you'll ever deploy, and in this specific attack it would have surfaced the problem on week one instead of week six.
The uncomfortable read on this story is that the self-hosted ecosystem has quietly become critical infrastructure for millions of people without ever growing up security-wise, and the first serious wave of targeted griefing is now visible on the horizon. The *arr maintainers are volunteers shipping remarkable software for free; the burden of modern auth defaults shouldn't land on them alone. But projects like Authentik, Pocket ID, and Cloudflare Access have made SSO-in-front-of-everything a weekend project rather than a quarter-long migration. The next time you spin up a new container with a web UI, the question isn't whether to put auth in front of it. It's which of the three or four free options you're going to use. The developer who wrote this postmortem learned that the expensive way. The rest of us get to read it for free.
> Not even a folder with a fake .mkv and a "codec installer" next to it like the "good old days". Just the exe. Are we deadass.We can thank Microsoft for their willful support of criminals by having file extensions be hidden by default in Windows.
Joining private trackers is hard only if you are trying to join the niche ones which is totally unnecessary if you are trying to watch relatively recent and popular movies.Just get into a decent general tracker and you'll literally never have this issue again (along with getting torrents with m
If you are too lazy to join private trackers, at least use TraSH guides to set up quality profileshttps://trash-guides.info/
> It even grabs your Sticky Notes for WHAT????The whole sticky notes next to monitor is not a joke. I bet you could grab some crypto recovery keys this way
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.
Sonarr has an advanced setting in "Settings > Indexers > [Your indexer] > Fail Downloads" which you should add "Executables" to. Then these kinds of downloads get automatically marked as failed/blacklisted and a new search and new download is attempted without you n