Security precautions

Flood usually has wide-ranging privileges to files.

• NEVER run Flood with root or users with NOPASSWD sudo privilege.
• Prohibit PHP or other dynamic pages from executing inside Flood directory (if static assets are served directly via web server).
• Deny Flood write access and ownership to Flood's own files. Flood only needs to have r/w access to its database (dbPath) and download destinations.
• Use SSL to defeat on-path attackers. Your password is in cleartext during authentication. If you don't use SSL, makes sure that the connection path is not vulnerable to eavesdropping. Plus, don't (re)use your favorite password(s).
• While maintainers of Flood will try their best to make sure the built-in authentication system of Flood is secure, in high-stake environments, it is recommended to use HTTP Basic Auth or other battle-hardened authentication methods instead of Flood's in-house one. You can use disableUsersAndAuth to avoid duplicate authentication.
• Avoid exposing Flood to Internet unless you are sure that you got security right.

rTorrent's script and command interface ALLOWS arbitrary code execution. IT IS NOT PROTECTED.

• NEVER run rTorrent with root or users with NOPASSWD sudo privilege.
• NEVER expose rTorrent's SCGI interface to Internet (or even local network).
• Avoid using SCGI host:port mode of rTorrent. It may allow local privilege escalation (to rTorrent's account) as ports can be still accessed by any local program even if you use 127.0.0.1 as listening host.
• Use SCGI socket mode of rTorrent. Only allows Flood to access the socket. execute.nothrow = chmod,770,(cat,/path/to/rtorrent.sock)

Containers

• Container technologies can reduce attack surface and restrict scope of access. However, you should still pay attention to security. Intruders do NOT need to break out of container (or even get root access) to initiate cryptomining, spam email sending or using the compromised instance as proxy to attack your internal network.