Protect administration and credentials whether or not the stream is public. Sources, listeners, authentication backends and administrators have different tasks and need different permissions. Even a private installation can be exposed through compromised clients or accidentally published files.
Reduce privileges and public surfaces
Run under a dedicated service identity with writable access only to required runtime and log locations. Keep configuration, user files, private keys and backups outside all served roots. Do not use demonstration passwords. Generate different source, relay and administrator secrets and rotate them through a planned transition.
Restrict management access at the network boundary and use protected transport. Do not embed administrator credentials in JavaScript, playlists, players or monitoring URLs. Administrative GET actions can change state, so avoid browsing untrusted pages in an authenticated administration session.
Define proxy and callback trust
KH can use forwarding information, including configured x-forwarded-for handling. Trust only a known proxy path that replaces client-supplied forwarding headers. A direct listener must not be able to invent another client’s address and bypass restrictions or corrupt accounting.
URL authentication calls a service with connection data. Limit destination access, retain certificate verification and keep authentication results out of public logs. Test missing approval headers, backend timeout and failure. The existence of an optional command authenticator in the source does not make executing client-controlled commands safe; use only reviewed fixed programs in an isolated service boundary if such a backend is required.
Make an update and recovery plan
Record the exact binary provenance, source commit, linked libraries and configuration revision. The master snapshot covered here is later than the kh22 release despite sharing its version string. A version label alone does not establish installed fixes or current support.
Keep restricted backups and test restoration in isolation. Exercise denied listener access, source credential failure, a rejected callback, certificate expiry handling and a rollback with compatible configuration. No penetration test or live vulnerability clearance is claimed here. For migration boundaries use the update procedure.