[mintlify]

Summary

Documents how the saved Prowlarr sync API key is stored and protected, and how the insecure-LAN opt-in works for indexers.

Changes

• SECRETS.md §4: saved Prowlarr URL, API key (encrypted enc:v1:), and options are now stored in system_config. The settings endpoint returns the "********" placeholder, and the sync route only accepts the placeholder for the saved URL.
• Notes that losing CREDENTIALS_ENCRYPTION_KEY also affects the saved Prowlarr key.
• Adds the per-indexer allowInsecureLan opt-in: bulk setting from the sync dialog (unticked by default, never inferred), withheld-key hint on 401/403, /test endpoints honoring it, and migration 0033 leaving existing indexers opted out.

Context

Follow-up to #1148, which updated API.md but not the security docs.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated
questarr	🟢 Ready	View Preview	Oct 8, 2026, 7:09 AM

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 67e0cec2-f961-40e0-b235-f6c8e6241193

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[Doezer]

wshm · Automated triage by AI

📊 Automated PR Analysis

📝 Type	docs
🟢 Risk	low

Summary

This PR updates SECRETS.md documentation to describe how Prowlarr sync settings (URL, encrypted API key, sync defaults) are stored and masked, and documents the per-indexer allowInsecureLan opt-in behavior including migration 0033 and related endpoint behaviors. It is a documentation-only follow-up to a prior PR that updated API.md but not the security docs.

Review Checklist

• Tests present
• Breaking change
• Docs updated

Linked issues: #1148

---

Analyzed automatically by wshm · This is an automated analysis, not a human review.