Finding
get_queue_snapshot (GET /api/v1/downloads, line 127) requires only AuthenticatedUser (unlike the RequireAdmin enqueue/cancel/reprioritize siblings) and returns each item's raw download_url, which by Torznab/Newznab convention embeds the indexer apikey/passkey — so a non-admin member harvests the admin's private-tracker credentials, despite the codebase already redacting api keys to has_api_key in IndexerResponse.
Evidence
crates/paroche/src/routes/download.rs:127. Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).
Why this matters
Any authenticated non-admin user can harvest the admin's private-tracker/indexer API key or passkey by reading the plaintext download_url returned in the queue snapshot.
Desired correction
Redact or strip the credential-bearing query params from download_url in DownloadResponse (or gate get_queue_snapshot behind RequireAdmin); note the identical raw-download_url exposure exists in the AuthenticatedUser-gated POST /api/v1/search and needs the same treatment.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.
Finding
get_queue_snapshot (GET /api/v1/downloads, line 127) requires only AuthenticatedUser (unlike the RequireAdmin enqueue/cancel/reprioritize siblings) and returns each item's raw download_url, which by Torznab/Newznab convention embeds the indexer apikey/passkey — so a non-admin member harvests the admin's private-tracker credentials, despite the codebase already redacting api keys to has_api_key in IndexerResponse.
Evidence
crates/paroche/src/routes/download.rs:127. Surfaced by the 2026-07-03 deep-audit workflow (adversarially verified + Opus-judged).Why this matters
Any authenticated non-admin user can harvest the admin's private-tracker/indexer API key or passkey by reading the plaintext download_url returned in the queue snapshot.
Desired correction
Redact or strip the credential-bearing query params from download_url in DownloadResponse (or gate get_queue_snapshot behind RequireAdmin); note the identical raw-download_url exposure exists in the AuthenticatedUser-gated POST /api/v1/search and needs the same treatment.
Done when: the defect's failure mode no longer reproduces and a regression test covers it.