Security precautions

Flood usually has wide-ranging privileges to files.

• NEVER run Flood with root or users with NOPASSWD sudo privilege.
• Prohibit PHP or other dynamic pages from executing inside Flood directory (if static assets are served directly via web server).
• Deny write access and ownership to Flood's own files after npm build. Flood only needs to have r/w access to its database (dbPath) and download destinations.
• Use HTTP Basic Auth or other battle-hardened authentication methods instead of Flood's in-house one. You can use disableUsersAndAuth to avoid duplicate authentication.
• Avoid exposing Flood to Internet unless you are sure that you got security right.

rTorrent's script and command interface ALLOWS arbitrary code execution. IT IS NOT PROTECTED.

• NEVER run rTorrent with root or users with NOPASSWD sudo privilege.
• NEVER expose rTorrent's SCGI interface to Internet (or even local network).
• Avoid using SCGI host:port mode of rTorrent. It may allow local privilege escalation (to rTorrent's account) as ports can be still accessed by any local program even if you use 127.0.0.1 as listening host.
• Use SCGI socket mode of rTorrent. Only allows Flood to access the socket. execute.nothrow = chmod,770,(cat,/path/to/rtorrent.sock)

Containers

• Container technologies can reduce attack surface and restrict scope of access. However, you should still pay attention to security. Intruders do NOT need to break out of container (or even get root access) to initiate cryptomining, spam email sending or using the compromised instance as proxy to attack your internal network.