Skip to content

Security and Privacy

Release trust

Official Windows binaries are currently unsigned. Microsoft SmartScreen and heuristic antivirus products may warn about uncommon unsigned executables. A warning should be investigated, not automatically ignored.

Older VirusTotal behavior reports have described parts of ani-cli-rs as obfuscated. Expected implementation behaviors that can contribute to heuristic classifications include:

  • decoding provider-prefixed Base64URL metadata and parsing provider HTML/JSON;
  • resolving temporary media URLs;
  • binding a temporary loopback-only HLS compatibility relay;
  • launching mpv, VLC, Syncplay, aria2c, yt-dlp, or FFmpeg;
  • an installer modifying the current user's PATH.

The application does not require administrator privileges.

Verify a release archive

Every release package must have a matching .sha256 asset. The install scripts verify it automatically.

PowerShell using built-in .NET hashing:

$path = ".\ani-cli-rs-VERSION-x86_64-pc-windows-msvc.zip"
$stream = [System.IO.File]::OpenRead($path)
try {
    $sha = [System.Security.Cryptography.SHA256]::Create()
    try { ([BitConverter]::ToString($sha.ComputeHash($stream))).Replace("-", "") }
    finally { $sha.Dispose() }
} finally { $stream.Dispose() }

Linux:

sha256sum ani-cli-rs-VERSION-x86_64-unknown-linux-musl.tar.gz
cat ani-cli-rs-VERSION-x86_64-unknown-linux-musl.tar.gz.sha256

A matching hash proves the file is byte-for-byte identical to the published release asset. It does not independently prove the publisher or source is trustworthy.

Build from tagged source

Users who prefer not to trust a prebuilt binary can inspect a release tag and run:

cargo build --release --locked

Reproducible byte-for-byte output is not promised across compiler versions, linkers, operating systems, or build paths.

Network behavior

Depending on the command, ani-cli-rs contacts:

  • Anikoto API, AniList, Anikoto.cz, and its optional mapper endpoint;
  • third-party media/provider hosts returned for the selected episode;
  • AnimeSchedule for --nextep-countdown;
  • GitHub Releases for update checks and installation.

Third-party services see ordinary network metadata such as public IP address, TLS/client characteristics, user agent, and requested resource. Their privacy policies are outside this project's control.

Logs and issue reports

Routine scraper logs redact complete signed URLs, but users should still inspect logs. Never publish:

  • cookies or authorization headers;
  • complete temporary media query strings;
  • active provider tokens;
  • decrypted raw episode payloads;
  • personal home/build paths;
  • private network or account identifiers.

Vulnerability reporting

Do not open a public issue for command execution, credential exposure, path escapes, release replacement, or similar security impact. Use GitHub's private advisory form:

https://github.com/vorlie/ani-cli-rs/security/advisories/new

Provider outages, expired URLs, ordinary antivirus heuristics, and playback failures belong in public bug reports.

External plugins

The plugin system is a roadmap, not a shipped feature. The proposed design uses external executables rather than Rust .dll/.so loading. Such plugins would be trusted native code running as the current user; no plugin should be installed or executed merely because it appears in the current directory.