INFUSION

Support

What INFUSION needs, why installing is manual, and how to report a problem.

What INFUSION needs

Neither is required to install the app, but there will be nothing to play until at least one source is connected. There is no INFUSION account, no subscription and nothing to activate.

Why installing and updating is manual

INFUSION is a public alpha and is not distributed through an app store, so there is no store to notify you about a new version. You install the app yourself and you update it the same way, over the top, with the same command or the same file-manager route — the steps are on the Install page.

The app can check once, when it starts, whether a newer public alpha has been published, and offer it to you. You always confirm the install in Android's own installer, no download runs before you press Update, and nothing installs silently in the background.

Report a problem

If you think you have found a security problem, do not open a public Issue, discussion, pull request or comment. Follow the security policy below: it names the private channel, and it explains what to do if that channel is not offered.

For anything that is not a security problem — a bug, a question, a request — the issue tracker of the public releases repository is the place: https://github.com/Addonniss/infusion-releases/issues. A public report must not contain credentials, tokens, server addresses, add-on URLs or personal media titles. Remove them before you post.

Security policy

The project's security policy, reproduced from its own file.

Reporting a vulnerability

Do not report a vulnerability in a public Issue, discussion, pull request or comment. A public report tells everyone how to abuse the problem before a fix exists, and it cannot be withdrawn.

Report privately, through GitHub's private vulnerability reporting on the public releases repository:

https://github.com/Addonniss/infusion-releases/security/advisories/new

Private vulnerability reporting is enabled on that repository, so the form is available there. It is visible to the maintainer only, and it is the supported private channel and the fastest one.

If the private form is not available

If that page does not offer a private report form (for example if private reporting is ever disabled on the repository), open an Issue in https://github.com/Addonniss/infusion-releases containing only the sentence "security report: please open a private channel" — no technical detail, no reproduction steps, no affected version — and wait to be contacted. The details belong in the private channel, not in the Issue.

There is no security email address. Please do not guess one, and do not send reports to any address you find elsewhere.

What to include in a private report

  • the INFUSION version (versionName, versionCode) and the device or Android version;
  • what the problem allows an attacker to do, and what they need in order to do it;
  • the shortest reproduction you can give;
  • any evidence (logs, captures) — with credentials, tokens, server addresses, add-on URLs and personal media titles removed.

Scope

In scope:

  • the Android TV application (dev.infusion.tv) as distributed from https://github.com/Addonniss/infusion-releases;
  • its handling of credentials, tokens and configured add-on or server URLs;
  • its network transport and destination validation;
  • the update check and the download of a release asset.

Out of scope:

  • the Jellyfin server, the add-ons, the metadata services and the tracking services themselves — report those to their own projects;
  • vulnerabilities that require a rooted device, a modified system image, or physical access to an unlocked device, unless the specific claim is that INFUSION stores something it should not;
  • reports produced only by an automated scanner with no demonstrated impact;
  • social engineering, denial of service by sheer volume, and spam.

What to expect

INFUSION is an independent personal project maintained by one person. Reports are read, and genuine security problems are fixed before they are discussed in public, but no response time or fix deadline is promised. If a report is valid you will be credited in the release notes for the fix unless you ask not to be.

Supported versions

Only the most recent public release is supported. Pre-release ("alpha") builds are supported on a best-effort basis: a report against an older alpha build is welcome, but the fix will normally land in the next release rather than in a patch for the old one.