intro-skipper · Last updated: September 9, 2026

Please report security issues privately through GitHub: Report a vulnerability, or the Security tab of whichever intro-skipper repository is affected. Private reporting is enabled across the organisation, so a report stays between you and the maintainers until a fix is published.

If GitHub is not an option, email info@intro-skipper.org.

Please do not use a public issue, pull request, discussion, or Discord message for a suspected vulnerability.

• Plugin version and Jellyfin server version
• Operating system and install method (Docker, native package, …)
• What an attacker gains, and what access they need to start
• Steps to reproduce, or a proof of concept
• Relevant log output, with paths and tokens redacted

intro-skipper is a volunteer-maintained project, so handling is best effort. We aim to acknowledge a report within 7 days. Once a report is confirmed we will fix it on the supported branch, publish a GitHub Security Advisory, and credit you unless you would rather stay anonymous. We would appreciate you holding off on public disclosure until that advisory goes out.

The plugin tracks Jellyfin's release cadence. Only the plugin line targeting the current stable Jellyfin release receives security fixes. There is no long-term support line and no fixed support window measured in months or years — when Jellyfin promotes a new stable release, the plugin branch for the previous one stops receiving fixes.

If you run an older Jellyfin server, upgrading Jellyfin is the remediation path — fixes are not backported. The manifest at https://intro-skipper.org/manifest.json serves builds matched to the Jellyfin version that requests it, so an outdated server keeps being offered the last build made for it. That build is frozen, not maintained.

In scope:

• The plugin, including its bundled configuration page assets
• The build and release workflows, and the artifacts they publish
• The manifest and web properties operated by intro-skipper

Out of scope — please report these upstream instead:

• The Jellyfin server, its API, or its web client → jellyfin/jellyfin
• jellyfin-ffmpeg → jellyfin/jellyfin-ffmpeg
• Forks, third-party builds, or manifests not published by this organisation

Plugin settings are administrator-only by design, so a finding that requires an existing administrator session or an already-compromised server is generally not treated as a vulnerability. If you are unsure, report it anyway and we will route it.

Release binaries are signed through SignPath. Releases on the supported line also ship an SPDX SBOM alongside the plugin archive, and publish two GitHub attestations bound to IntroSkipper.dll — a SLSA build provenance attestation covering how the binary was built, and an SBOM attestation covering what is inside it.

To check a download, extract IntroSkipper.dll from the release archive and run gh attestation verify IntroSkipper.dll --repo intro-skipper/intro-skipper. Both attestations are reported; add --predicate-type to check one in particular.

• Security reports: GitHub Security Advisories
• Email: info@intro-skipper.org
• Discord: https://discord.gg/AYZ7RJ3BuA (general questions only — never vulnerability details)