Please report security issues privately rather than through a public GitHub issue. Use GitHub's private security advisory form:

https://github.com/SemHiel2003/OmenPlayer/security/advisories/new

This lets us discuss and fix the issue before any details are public. Please include:

• A description of the issue and its impact.
• Steps to reproduce, or a minimal example, where possible.
• The OmenPlayer version/build you tested against.

We'll acknowledge reports and work with you on a fix and disclosure timeline. Public issues are fine for non-security bugs; please don't use them for anything that could be exploited before a fix ships.

Only the latest release is supported with security fixes. If you're running an older build, please update before reporting — the issue may already be fixed.

• User credentials: IPTV (M3U/Xtream), Plex, and OpenSubtitles login details that you enter are stored in config.json under %AppData%/Omen/OmenPlayer/. Sensitive fields (passwords, tokens) are encrypted with Windows DPAPI before being written to disk — DPAPI ties the encryption to your Windows user account, so the file is not portable or readable outside your login. This is local storage only; nothing is sent to a server operated by this project.
• Baked-in application API keys: OmenPlayer optionally talks to MDBList (ratings) and OpenSubtitles using API keys that are compiled into the binary at build time via -DOMEN_MDBLIST_API_KEY / -DOMEN_OPENSUBTITLES_API_KEY. These are not treated as secrets. Any API key embedded in a desktop application binary can be extracted with tools as simple as strings on the executable — there is no way to hide a client-side key from someone who has the binary. Because of this, such keys are considered public and rotatable, not confidential, and their exposure is not something we can meaningfully "fix" as a vulnerability in the usual sense. If you find one of these keys in the binary, that is expected behaviour, not a bug — though abuse of a leaked key against the upstream service is still worth reporting so it can be rotated.

This policy covers the OmenPlayer application itself (this repository). It does not cover the security of third-party services you connect it to (your IPTV provider, Plex server, OpenSubtitles, MDBList) — please report issues with those services to their respective operators.

This is a best-effort, community-maintained project. We'll do what we reasonably can, but there are no guaranteed response times or formal SLAs.