# Picks for the operator — flaws with no fix inside the main version (2026-10-27)

No template was changed for any of these. Each pick: the question, CC's pick first, the cost of the other, and what
happens if nobody decides. Fleet fact for all of them (hub 2026-10-27): **no box runs any of these apps**; the risk is a
NEW install.

## 1. SparkyFitness — two notices, no fix released (GHSA-p8cf-g8rv-gvrq, GHSA-cmmf-53wf-r5gv)

What a stranger can do with our template: nothing without an account or a leaked photo URL. p8cf needs a household
account (it overwrites another member's Withings link); cmmf needs the exact URL of an owner-only photo. A third notice
(GHSA-v883) does not apply: our template generates `BETTER_AUTH_SECRET` per install.

- **A (CC's pick): leave it offered and wait for the upstream fix**, then take it with R-785's big step (0.17 → 1.x).
  Cost: a family that installs it meanwhile carries two medium flaws that need one of its own accounts.
- **B: hide it from new installs** (`lifecycle: hidden`) until a fixed version is proven. Cost: the app disappears from
  the catalog for an unknown time.
- **If you do nothing:** A.

## 2. Gitea — GHSA-rqhx-647v-wx32: SSRF through a redirect in repository migration (the upstream patch was reverted)

What a stranger can do: nothing without an account (sign-up is closed twice in our template). A household account can
make the box fetch an internal address through „New migration".

- **A (CC's pick): leave migrations on**, and judge it again in Gitea's big step (1.27.3 → 28.2.0, which fixes 40 other
  notices). Cost: a signed-in household member can reach the home network through the migration form.
- **B: turn migrations off** (`GITEA__repository__DISABLE_MIGRATIONS=true`). Cost: the household cannot import a
  repository from GitHub any more.
- **If you do nothing:** A.

## 3. Termix — GHSA-7j7m-85p4-2cpm: a stranger skips the login rate limit with a forged X-Forwarded-For (R-1311)

The fix is Termix's big step (2.8 → 2.9.2 → 26.10.5, two hops).

- **A (CC's pick): wait for the big step.** Cost: until then, a stranger can guess passwords faster than the limit means.
- **B: strip the header in the template now** (as docmost and paperless do, R-753). Cost: every visitor then shares the
  tunnel's one address, so a stranger's wrong guesses can lock the household out of the login (the Grimmory shape,
  R-775).
- **If you do nothing:** A.

## 4. The big steps a stranger can use before they are done (Wanderer, Jellyfin, Gitea, Termix)

Wanderer's critical notice (GHSA-fprh-3pp9-68m9: any remote ActivityPub server overwrites records, no login, federation
has no off switch) is the worst open item. Jellyfin (GHSA-hw73, a file read with no login), Gitea (two notices with no
login) and Termix (above) follow.

- **A (CC's pick): hide Wanderer from new installs** (`lifecycle: hidden`) until its big step (v0.21.2) is proven; leave
  the others offered. Cost: Wanderer leaves the catalog for the days its step takes.
- **B: leave all four offered.** Cost: a new Wanderer install is open to any federated server from its first day.
- **If you do nothing:** B.