Report it privately. Please do not open a public issue for a security problem: an issue is visible to everyone the moment you file it, including whoever would use the bug.

An OP3 API token, if you supply one. Without it the server falls back to OP3's shared preview token, which is rate limited and reads the same public data.

The token grants read access to public podcast analytics. It is not tied to a podcast you own and it cannot change anything, so the blast radius of a leak is somebody else reading public numbers on your quota.

There is no backend and no telemetry. Requests go to OP3 and nowhere else.

There is no write path. OP3 exposes no write API, so this server reads and nothing more.

Show titles, episode titles and feed metadata come from other people's RSS feeds. Treat them as data to report on, never as instructions.

The HTTP transport has no authentication of its own and belongs behind TLS and an authenticating proxy. The data is public, but an open endpoint spends your rate limit for anyone who finds it.

Read, run and pull apart anything here. Nobody but the maintainer can change this repository, so nothing you do while investigating puts it at risk.

The care is owed to the service the tool talks to, not to the code. When testing, use your own account and your own data. Do not point it at somebody else's, and do not hammer a shared API to the point where other people notice. If a test could affect anyone but you, stop and send a private report first.

Research done in that spirit is welcome, and nothing here is a trap.

The latest published version gets fixes.