Tube Archivist stores downloaded videos, metadata, subtitles, and search indexes for a personal or shared media library. It can also accept a forward-authentication username from a proxy and promote selected users to superuser. A small external count does not make those authorities unimportant.

Keep the measurement honest

At 2026-11-06T17:50:44 UTC, a count-only ZoomEye query used http.body="Tube Archivist" with sub_type=all, page 1, and page size 1. It returned 123 matches. A product-name body match can include documentation and references, so the result is a discovery lead rather than a verified count of running archives.

The same series returned zero on both app="Tube Archivist" and title="Tube Archivist". Those are valid zero totals for specific fields. They do not cancel the body match and do not prove that no Tube Archivist instance is reachable.

Treat the API key and session as different credentials

Tube Archivist's API documentation says a token must be passed in an authorization header, and an authenticated browser session can also use the API. The API key is available on the settings page. Restrict who can view it, rotate it after an integration change, and avoid putting it in browser bookmarks or public automation code.

Review the API scope. A user token should not be able to perform actions reserved for a superuser. Test version-specific endpoints because the API is under active development. Record the version with every authorization test so a later result is not applied to a different interface.

Make forward authentication explicit

Tube Archivist can use a proxy-supplied username header for authentication. The proxy must strip client-supplied versions of that header and set a trusted value only after successful authentication. If the backend port is reachable directly, the header contract can be bypassed.

The forward-auth documentation notes that new users can be created automatically and that a selected proxy identity can receive administrative rights. Review the header name, the proxy route, the default user role, and the list of promoted users. Test with a new proxy identity and an unauthenticated direct request.

Inventory the archive and its index

Record the application host, owner, version, authentication mode, user list, API-key owner, media paths, and Elasticsearch service reachability. The search index may contain titles, descriptions, comments, and subtitles that reveal more than the video files themselves. Keep it on the private service network and restrict credentials.

Monitor logins, API-key use, user creation, superuser changes, download jobs, and search-index access. If a capture or index token is exposed, determine whether it can only read data or also trigger jobs and changes.

A 123-match body query is not a large internet census. It is still enough to find candidates that should be compared with ownership and configuration records. For Tube Archivist, the valuable question is who appears to be a trusted proxy user and who can act as a superuser.

References