From a71a47f76a9b3c4a7f3a7fb600c052da15755c57 Mon Sep 17 00:00:00 2001
From: TorMatzAndren <tmw82x@gmail.com>
Date: Sat, 16 May 2026 13:10:00 +0200
Subject: [PATCH] Document Jarri Spooty hardening updates

---
 CHANGELOG.md |  6 ++++++
 README.md    | 14 +++++++++-----
 2 files changed, 15 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 653dedc..3868bdd 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -64,6 +64,12 @@ This project follows a practical chronological changelog rather than autogenerat
 - Added isolated Spotify credential storage
 - Added safer cookie handling flow
 - Improved Docker secret isolation documentation
+- Removed unused downloader dependencies to reduce transitive attack surface
+- Hardened download filename sanitization
+- Hardened remote cover-art fetching with protocol, MIME, timeout, and size checks
+- Added yt-dlp subprocess timeout and single-settlement handling
+- Shaped track websocket payloads to avoid leaking internal entity fields
+- Normalized visible project naming to Jarri Spooty
 
 ### Frontend
 
diff --git a/README.md b/README.md
index bbf5f8d..d2df967 100644
--- a/README.md
+++ b/README.md
@@ -21,6 +21,8 @@ This hardened branch focuses on:
 - Persistent SQLite state across container restarts
 - Deterministic Docker config persistence
 - Improved operational observability
+- Reduced unused dependency surface
+- Hardened filename, cover-art, subprocess, and websocket boundaries
 
 ---
 
@@ -40,6 +42,8 @@ This hardened branch focuses on:
 - Automatic YouTube retry/fallback handling
 - Failed YouTube candidate rejection memory
 - Deterministic yt-dlp error classification
+- Hardened cover-art validation and embedding
+- Explicit client-facing websocket payload shaping
 
 ---
 
@@ -136,7 +140,7 @@ docker run --rm -p 3000:3000 \
   -v "$PWD/downloads:/spooty/backend/downloads" \
   -v "$PWD/spooty-config:/spooty/backend/config" \
   -v "/etc/tokens/youtube.cookies.txt:/spooty/config/youtube.cookies.txt:ro" \
-  spootyfy-hardened:local
+  jarri-spooty:local
 ```
 
 Open:
@@ -158,8 +162,8 @@ Then:
 ```yaml
 services:
   spooty:
-    image: spootyfy-hardened:local
-    container_name: spooty
+    image: jarri-spooty:local
+    container_name: jarri-spooty
     restart: unless-stopped
 
     ports:
@@ -204,7 +208,7 @@ services:
 ```bash
 npm install
 npm run build
-docker build -t spootyfy-hardened:local .
+docker build -t jarri-spooty:local .
 ```
 
 ---
@@ -493,7 +497,7 @@ docker run --rm -p 3000:3000 \
   -v "$PWD/downloads:/spooty/backend/downloads" \
   -v "$PWD/spooty-config:/spooty/backend/config" \
   -v "/etc/tokens/youtube.cookies.txt:/spooty/config/youtube.cookies.txt:ro" \
-  spootyfy-hardened:local
+  jarri-spooty:local
 ```
 
 ---