Please do not open a public issue for a suspected vulnerability. Use the repository host's private security-advisory feature to report it to the maintainers. Include the affected version, reproduction steps, and impact.

Emby Guide is intended for a trusted household network. It exposes the Emby profile picker and can start playback on active Emby devices. If you make it internet-accessible, put it behind HTTPS and an access-control layer, and complete first-run setup before exposing it.

The Emby administrator API key is encrypted at rest. Back up the master-key volume separately from, but alongside, the data volume. Anyone with both can decrypt the saved key. Never commit either volume, an .env file containing credentials, or an API-key file.