Security and Package Trust

Security and Package Trust

Supported versions

The latest tagged release on main is supported. dev is best-effort prerelease testing; older releases are unsupported.

Installation trust

The plugin manifest publishes MD5 for compatibility and SHA-256 as the security boundary for the core archive and icon pack. Packages include build metadata and an installed-runtime integrity manifest.

Diagnostics can report missing files, modified content, unexpected executable/runtime files, unreadable files, and changed modes. Integrity checking is detection-only: FolderView Plus does not silently overwrite findings.

GitHub attestations and SBOM

Stable releases publish provenance attestations for the archive/checksum and a CycloneDX SBOM attestation. Administrators can verify a downloaded stable archive online:

gh attestation verify folderview.plus-YYYY.MM.DD.UU.txz \
  --repo alexphillips-dev/FolderView-Plus

Unraid installation does not require GitHub CLI; it uses manifest checksum verification.

Continuous security monitoring

Repository security checks run without connecting to an Unraid server:

• CodeQL analyzes dev and main changes and performs a weekly scan.
• Dependency Review blocks pull requests that introduce high/critical known vulnerabilities or unapproved licenses.
• OpenSSF Scorecard publishes a weekly supply-chain posture report to GitHub code scanning.
• OSV Scanner checks the generated CycloneDX inventory every Wednesday, retains SARIF evidence, publishes supported findings to code scanning, and fails when it reports a known vulnerability.
• A scheduled-workflow watchdog maintains one recovery issue if CodeQL, Scorecard, OSV, or another expected scheduled validation stops producing timely successful runs.

OSV can evaluate versioned components with supported package identifiers. Host-provided or vendored snapshots without a reliable package identifier remain in the inventory for manual upstream review; they are not silently described as scanned. These workflows use isolated runners and public upstream inputs. They do not store live-Unraid URLs, sessions, cookies, credentials, or API keys.

Request protection

Plugin-owned mutations use POST, an install-specific request marker/token, same-origin checks, a short-lived endpoint/action-bound nonce, a unique transaction ID, and rate limits. Mutation retries remain disabled; uncertain results are reconciled from current state instead of replaying a write.

FolderView Plus supports a TLS-terminating reverse proxy without disabling those controls. The proxy must provide one coherent Host, X-Forwarded-Host, X-Forwarded-Proto, and X-Forwarded-Port authority. The forwarded hostname must match the browser-facing host, the protocol must be http or https, and any explicit forwarded-host port must match the forwarded port. Partial, repeated, malformed, conflicting, or spoofed values fail closed.

Standard LinuxServer SWAG proxy.conf supplies the required headers. Do not inject X-FV-Request, remove browser Origin/Referer headers, or disable the request guard; the FolderView Plus request client supplies its own marker. See Troubleshooting for the supported configuration and diagnostic flow.

Ephemeral nonce/rate state lives under /var/run/folderview.plus and resets on reboot. Security audit entries deliberately omit names, paths, addresses, URLs, payloads, tokens, and nonces.

Secure administration practices

• Use the stable manifest for production.
• Keep Unraid and browsers updated.
• Do not expose the Unraid webGUI directly to the public internet.
• Review custom themes, CSS, JavaScript, and User Scripts before enabling them.
• Keep external backups of configuration exports.
• Review integrity findings before reinstalling.
• Never post raw configuration or credentials in issues.

Report a vulnerability

Do not open a public issue. Go to the repository Security tab, choose Report a vulnerability, and include affected FolderView Plus/Unraid versions, reproduction, impact, and privately reviewed evidence.

Response targets are an initial acknowledgement within 72 hours and triage/severity assessment within 7 days. A mitigation/fix timeline follows triage.

In scope: PHP endpoints, browser runtimes, import/export/recovery, packaging, storage/process boundaries, privacy/injection defenses, replay/rate controls, and runtime integrity. Unraid core and third-party plugin/theme vulnerabilities are out of scope unless the defect is in FolderView Plus integration.

Authoritative references: Security policy · Package trust · Request security