Security Policy
Only the latest public release is supported for security fixes. Update before reporting unless the issue also reproduces on the latest version.
Reporting a vulnerability
Do not post tokens, config files, logs, screenshots with secrets, or exploit details in a public issue. Use GitHub private vulnerability reporting, which is enabled for the repository.
Enhanced metadata hardening
- The debug port is randomly selected from a high local port range.
- The selected port is stored in memory for the app session.
- The app validates the Amazon page, exact target identifier, selected loopback port, WebSocket URL, and listener ownership.
- The common DevTools port
9222is not used for launching Amazon Music.
Tokens and secrets
Last.fm and ListenBrainz tokens are stored in Windows Credential Manager when enabled. A DPAPI-protected local file is used only as a verified compatibility fallback. Diagnostics redact known token values, but the app data directory should still be treated as private.
Updates
The updater accepts only the expected GitHub repository and asset hosts, enforces size limits, and requires the detached AmazonMusicRPC_Setup.exe.sha256 asset before automatic installation. Official artifacts are created as unpublished drafts by a manually triggered GitHub Actions workflow for maintainer review.