bvandeusen/FabledCurator
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 13 Wiki Activity

docs: stop claiming pixiv, and stop claiming everything gallery-dl supports (406 step 4)
CI / lint (push) Successful in 3s
Details
CI / extension-version (push) Successful in 2s
Details
Build images / build-agent (push) Successful in 7s
Details
CI / frontend-build (push) Successful in 24s
Details
CI / backend-lint-and-test (push) Failing after 53s
Details
extension / lint (push) Successful in 22s
Details
Build images / build-ml (push) Successful in 2m10s
Details
CI / integration (push) Failing after 2m33s
Details
Build images / sign-extension (push) Successful in 5m33s
Details
Build images / build-web (push) Successful in 1m7s
Details
Build images / smoke-web (push) Skipped
Details
Build images / promote (push) Skipped
Details

Browse Source 
Ships with the switch-off rather than with the code removal: a doc that promises a platform the product refuses is the Install and Public Surface area's characteristic defect.

pixiv comes out of README (twice), SECURITY.md (twice), .env.example and the compose header. The stored-credential warnings now name Patreon and SubscribeStar - the accounts that usually carry a payment method.

One correction beyond pixiv. README said FabledCurator follows creators on Patreon, SubscribeStar, Pixiv "and anything gallery-dl supports". That was already false: a platform not in the registry is rejected, however capable gallery-dl is. It now names the real set, which rule 171 records: Patreon, SubscribeStar, Discord and HentaiFoundry.

The 3422 docs guards still hold - the key path and bootstrap variable are untouched.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SHQB1YukL3VyvMK8rcbmV9
This commit is contained in:
bvandeusen
2026-09-13 11:45:49 -04:00
co-authored by Claude Opus 5
parent e3fd8c67d4
commit c2f9e9cc08
4 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
SECURITY.md
+2 -2
View File
@@ -26,7 +26,7 @@ FabledCurator is self-hosted and holds things worth stating plainly, because
they shape what counts as a serious bug here:
- **Platform credentials.** The app captures and stores session cookies for
third-party subscription sites (Patreon, SubscribeStar, Pixiv) so it can
third-party subscription sites (Patreon, SubscribeStar) so it can
download on the operator's behalf. These are live credentials for accounts
that usually carry a payment method. Anything that discloses them, decrypts
them, or lets one user of a shared instance read another's is high severity.
@@ -56,7 +56,7 @@ reverse proxy. It also does not authenticate anyone — see above. These are
documented design decisions, not oversights.
Putting this on the public internet, with or without TLS, hands whoever finds
it your Patreon, SubscribeStar and Pixiv sessions. A reverse proxy that adds
it your Patreon and SubscribeStar sessions. A reverse proxy that adds
TLS but not an authentication layer does not change that.
Reports that reduce to "the application is served over HTTP", "there is no