A security fix goes to the newest release. No older version is maintained.

Report a security problem in private. Do not open a public issue.

• Best: open a private advisory with the "Report a vulnerability" button on the Security tab of the repository.
• Or write to the maintainer at stivenagostingjekaj@gmail.com.

Say how to make the problem happen again, which version you used, on which device, and what you believe the effect is. You can expect a first answer within a few days. Your report is named in the fix unless you ask to stay anonymous.

ZettaStream reads data that other people write: addon manifests and answers in JSON, M3U playlists, and XMLTV guides. These are in scope:

• A fault that lets one of these files run code, read a file of the app, or stop the app every time that it starts.
• A fault in the pairing page that the TV serves on the local network. The page must accept a list only with the token of the current QR code, and only one time. The backup, the restore, and the diagnostics pages also need the token. A request without the token cannot send a large body.
• A fault in the update inside the app. It downloads only the newest release of this repository, and Android installs it only when its signature is the same as the installed app.
• A restore that changes data from a file that is not a ZettaStream backup.
• A fault that shows or sends the source list, which can hold keys, to a person or a server that the user did not choose.
• A fault in the local server of the torrent engine. It must accept connections from 127.0.0.1 only, and it must serve only the file of an open torrent.
• A torrent file or a peer that makes the app run code or read a file outside its torrent folder.

• The content of a source. A source is a service of another party.
• The IP address that a torrent shows to its peers. That is how BitTorrent works. The app tells the user to use a VPN.
• A device on the same local network that can see the pairing page while the Sources screen is open. Without the token, it cannot send a list.
• A rooted device, or a person with physical access to the unlocked device.