Rules

A rule is the unit of detection. Each rule watches one qBittorrent category, ties it to one *arr app, and defines the conditions that make a torrent "bad." A torrent is evaluated against every rule whose category it belongs to.

You can have as many rules as you like, including multiple rules on the same category — for example one rule checking for executable extensions and another checking for a minimum file size.

---

Anatomy of a rule

rules:
  - name: "TV Bad Extensions"
    category: "tv-sonarr"
    app: sonarr
    conditions:
      match_mode: any
      bad_extensions: [".exe", ".bat", ".msi", ".scr"]
      min_file_size_mb: ~
      bad_filename_patterns: []

Field	Purpose
name	A label for the rule, shown in logs and notifications
category	The qBittorrent category to watch. In the Settings page this is a dropdown populated live from qBittorrent
app	Which *arr handles the blocklist when this rule fires: sonarr, radarr, or lidarr
conditions	One or more tests, described below

---

Match mode

match_mode: any        # or "primary"

• any — the torrent is flagged if any file in it matches a condition. This is the safe default for catching a small malicious payload hidden alongside legitimate files.
• primary — the torrent is flagged only if its largest file matches. Use this when you only care about the main payload and want to ignore small extras.

---

Conditions

A rule can use any combination of these. They are OR'd together — a torrent matching any one condition is flagged.

Bad extensions

bad_extensions: [".exe", ".bat", ".msi", ".scr", ".lnk", ".vbs", ".js"]

Flags a torrent containing a file with any of these extensions. The most common and most useful condition — a video torrent has no business containing an .exe.

Minimum file size

min_file_size_mb: 50

Flags a torrent whose primary (largest) file is smaller than this many megabytes. Catches fake releases that are really just a tiny text file or a link to malware. Leave as ~ (null) to disable.

Bad filename patterns

bad_filename_patterns:
  - "password.*\\.txt"
  - "readme.*\\.exe"
  - "(?i)install"

A list of regular expressions matched against filenames within the torrent. Anything matching flags the torrent. Patterns are full Python regular expressions, so escape literal dots (\\.) and use (?i) for case-insensitive matching.

Note: Regex patterns are powerful but easy to get wrong. Test a new pattern with dry_run: true (or the global Dry Run toggle) before turning it loose. A pattern like .* matches everything and will flag every torrent in the category — useful for a one-time test, dangerous left in place.

---

Multiple rules on one category

Two rules can watch the same category. A torrent in that category is evaluated against both. It's only ever actioned once — whichever rule flags it first blocklists and deletes it, and the second rule sees it's already been processed and skips it. The scan summary counts each torrent once regardless of how many rules matched it.

---

Testing a rule safely

The reliable way to confirm a new rule does what you expect:

1. Set the global dry_run: true (or toggle Dry Run in Settings → General).
2. Trigger a scan from the dashboard (Run Now).
3. Check the Web UI Events log for dry_run entries showing what would have been actioned.
4. Once satisfied, turn Dry Run off.

In dry-run mode nothing is blocklisted or deleted — matches are logged only.