Pin dotnet build version (#499)

.github/workflows/build-docker.yml

@@ -22,23 +22,32 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+  packages: write
+
+env:
+  REGISTRY_IMAGE: ghcr.io/cleanuparr/cleanuparr
+
 jobs:
-  build_app:
+  # Compute tags, version, and push decision for downstream jobs
+  prepare:
     runs-on: ubuntu-latest
+    if: github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository
+    outputs:
+      tags: ${{ steps.build-info.outputs.tags }}
+      version: ${{ steps.build-info.outputs.version }}
+      version_docker_tag: ${{ steps.build-info.outputs.version_docker_tag }}
+      branch: ${{ steps.build-info.outputs.branch }}
+      push: ${{ steps.build-info.outputs.push }}
+      github_sha: ${{ github.sha }}
     steps:
-
-      - name: Set github context
-        timeout-minutes: 1
-        run: |
-          echo 'githubRepository=${{ github.repository }}' >> $GITHUB_ENV
-          echo 'githubSha=${{ github.sha }}' >> $GITHUB_ENV
-          echo 'githubRef=${{ github.ref }}' >> $GITHUB_ENV
-          echo 'githubHeadRef=${{ github.head_ref }}' >> $GITHUB_ENV
-
       - name: Initialize build info
+        id: build-info
         timeout-minutes: 1
         run: |
-          githubHeadRef=${{ env.githubHeadRef }}
+          githubHeadRef="${{ github.head_ref }}"
+          githubRef="${{ github.ref }}"
           inputVersion="${{ inputs.app_version }}"
           latestDockerTag=""
           versionDockerTag=""
@@ -71,10 +80,8 @@ jobs:
               minorVersionDockerTag="${BASH_REMATCH[1]}.${BASH_REMATCH[2]}"
             fi
           else
-            # Determine if this run is for the main branch or another branch
             if [[ -z "$githubHeadRef" ]]; then
               # Main branch
-              githubRef=${{ env.githubRef }}
               branch=${githubRef##*/}
               versionDockerTag="$branch"
             else
@@ -85,25 +92,45 @@ jobs:
           fi
 
           githubTags=""
-
           if [ -n "$latestDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$latestDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$latestDockerTag"
           fi
           if [ -n "$versionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$versionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$versionDockerTag"
           fi
           if [ -n "$minorVersionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$minorVersionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$minorVersionDockerTag"
           fi
           if [ -n "$majorVersionDockerTag" ]; then
-            githubTags="$githubTags,ghcr.io/cleanuparr/cleanuparr:$majorVersionDockerTag"
+            githubTags="$githubTags,$REGISTRY_IMAGE:$majorVersionDockerTag"
           fi
 
-          # set env vars
-          echo "branch=$branch" >> $GITHUB_ENV
-          echo "githubTags=$githubTags" >> $GITHUB_ENV
-          echo "versionDockerTag=$versionDockerTag" >> $GITHUB_ENV
-          echo "version=$version" >> $GITHUB_ENV
+          githubTags="${githubTags#,}"
+
+          # Determine push decision
+          push="${{ github.event_name == 'pull_request' || inputs.push_docker == true }}"
+
+          echo "tags=$githubTags" >> $GITHUB_OUTPUT
+          echo "version=$version" >> $GITHUB_OUTPUT
+          echo "version_docker_tag=$versionDockerTag" >> $GITHUB_OUTPUT
+          echo "branch=$branch" >> $GITHUB_OUTPUT
+          echo "push=$push" >> $GITHUB_OUTPUT
+
+  # Build each platform in parallel
+  build:
+    runs-on: ubuntu-latest
+    needs: [prepare]
+    strategy:
+      fail-fast: false
+      matrix:
+        platform:
+          - linux/amd64
+          - linux/arm64
+    steps:
+      - name: Prepare platform pair
+        run: |
+          platform=${{ matrix.platform }}
+          echo "PLATFORM_PAIR=${platform//\//-}" >> $GITHUB_ENV
 
       - name: Get vault secrets
         uses: hashicorp/vault-action@v2
@@ -113,8 +140,6 @@ jobs:
           roleId: ${{ secrets.VAULT_ROLE_ID }}
           secretId: ${{ secrets.VAULT_SECRET_ID }}
           secrets:
-            secrets/data/docker username | DOCKER_USERNAME;
-            secrets/data/docker password | DOCKER_PASSWORD;
             secrets/data/github repo_readonly_pat | REPO_READONLY_PAT;
             secrets/data/github packages_pat | PACKAGES_PAT
 
@@ -122,16 +147,97 @@ jobs:
         uses: actions/checkout@v4
         timeout-minutes: 1
         with:
-          repository: ${{ env.githubRepository }}
-          ref: ${{ env.branch }}
+          repository: ${{ github.repository }}
+          ref: ${{ needs.prepare.outputs.branch }}
           token: ${{ env.REPO_READONLY_PAT }}
 
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v3
+
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v3
         timeout-minutes: 5
 
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v3
+      - name: Login to GitHub Container Registry
+        if: needs.prepare.outputs.push == 'true'
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.repository_owner }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Build and push by digest
+        if: needs.prepare.outputs.push == 'true'
+        id: build-push
+        timeout-minutes: 30
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ github.workspace }}/code
+          file: ${{ github.workspace }}/code/Dockerfile
+          provenance: false
+          labels: |
+            commit=sha-${{ needs.prepare.outputs.github_sha }}
+            version=${{ needs.prepare.outputs.version_docker_tag }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
+            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
+          platforms: ${{ matrix.platform }}
+          outputs: type=image,"name=${{ env.REGISTRY_IMAGE }}",push-by-digest=true,name-canonical=true,push=true
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          cache-to: type=gha,scope=build-${{ env.PLATFORM_PAIR }},mode=max
+
+      - name: Build (no push)
+        if: needs.prepare.outputs.push != 'true'
+        timeout-minutes: 30
+        uses: docker/build-push-action@v6
+        with:
+          context: ${{ github.workspace }}/code
+          file: ${{ github.workspace }}/code/Dockerfile
+          provenance: false
+          labels: |
+            commit=sha-${{ needs.prepare.outputs.github_sha }}
+            version=${{ needs.prepare.outputs.version_docker_tag }}
+          build-args: |
+            VERSION=${{ needs.prepare.outputs.version }}
+            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
+            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
+          platforms: ${{ matrix.platform }}
+          push: false
+          cache-from: type=gha,scope=build-${{ env.PLATFORM_PAIR }}
+          cache-to: type=gha,scope=build-${{ env.PLATFORM_PAIR }},mode=max
+
+      - name: Export digest
+        if: needs.prepare.outputs.push == 'true'
+        run: |
+          mkdir -p ${{ runner.temp }}/digests
+          digest="${{ steps.build-push.outputs.digest }}"
+          touch "${{ runner.temp }}/digests/${digest#sha256:}"
+
+      - name: Upload digest
+        if: needs.prepare.outputs.push == 'true'
+        uses: actions/upload-artifact@v4
+        with:
+          name: digests-${{ env.PLATFORM_PAIR }}
+          path: ${{ runner.temp }}/digests/*
+          if-no-files-found: error
+          retention-days: 1
+
+  # Create multi-platform manifest and push with final tags
+  merge:
+    runs-on: ubuntu-latest
+    needs: [prepare, build]
+    if: needs.prepare.outputs.push == 'true'
+    steps:
+      - name: Download digests
+        uses: actions/download-artifact@v4
+        with:
+          path: ${{ runner.temp }}/digests
+          pattern: digests-*
+          merge-multiple: true
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
 
       - name: Login to GitHub Container Registry
         uses: docker/login-action@v3
@@ -140,27 +246,25 @@ jobs:
           username: ${{ github.repository_owner }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - name: Build and push docker image
-        id: docker-build
-        timeout-minutes: 15
-        uses: docker/build-push-action@v6
-        with:
-          context: ${{ github.workspace }}/code
-          file: ${{ github.workspace }}/code/Dockerfile
-          provenance: false
-          labels: |
-            commit=sha-${{ env.githubSha }}
-            version=${{ env.versionDockerTag }}
-          build-args: |
-            VERSION=${{ env.version }}
-            PACKAGES_USERNAME=${{ secrets.PACKAGES_USERNAME }}
-            PACKAGES_PAT=${{ env.PACKAGES_PAT }}
-          platforms: |
-            linux/amd64
-            linux/arm64
-          push: ${{ github.event_name == 'pull_request' || inputs.push_docker == true }}
-          tags: |
-            ${{ env.githubTags }}
-          # Enable BuildKit cache for faster builds
-          cache-from: type=gha
-          cache-to: type=gha,mode=max
+      - name: Create manifest list and push
+        timeout-minutes: 5
+        working-directory: ${{ runner.temp }}/digests
+        run: |
+          tags="${{ needs.prepare.outputs.tags }}"
+          tag_args=""
+          IFS=',' read -ra TAG_ARRAY <<< "$tags"
+          for tag in "${TAG_ARRAY[@]}"; do
+            tag=$(echo "$tag" | xargs)
+            if [ -n "$tag" ]; then
+              tag_args="$tag_args -t $tag"
+            fi
+          done
+
+          docker buildx imagetools create $tag_args \
+            $(printf '${{ env.REGISTRY_IMAGE }}@sha256:%s ' *)
+
+      - name: Inspect image
+        run: |
+          tags="${{ needs.prepare.outputs.tags }}"
+          first_tag=$(echo "$tags" | tr ',' '\n' | grep -v '^$' | head -1 | xargs)
+          docker buildx imagetools inspect "$first_tag"

.github/workflows/build-executable.yml

@@ -74,9 +74,9 @@ jobs:
           token: ${{ env.REPO_READONLY_PAT }}
 
       - name: Setup dotnet
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.200
 
       - name: Cache NuGet packages
         uses: actions/cache@v4

.github/workflows/build-macos-installer.yml

@@ -84,9 +84,9 @@ jobs:
           path: code/frontend/dist/ui/browser
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.200
 
       - name: Restore .NET dependencies
         run: |

.github/workflows/build-windows-installer.yml

@@ -68,9 +68,9 @@ jobs:
           path: code/frontend/dist/ui/browser
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.200
 
       - name: Restore .NET dependencies
         run: |

.github/workflows/cloudflare-pages-blocklists.yml

@@ -20,6 +20,10 @@ jobs:
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
+
+      - name: Create directory for static files
+        run: |
+          mkdir -p Cloudflare/static
       
       - name: Copy root static files to Cloudflare static directory
         run: |

.github/workflows/test.yml

@@ -29,9 +29,9 @@ jobs:
         timeout-minutes: 1
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v4
+        uses: actions/setup-dotnet@v5
         with:
-          dotnet-version: 10.0.x
+          dotnet-version: 10.0.200
 
       - name: Cache NuGet packages
         uses: actions/cache@v4

CLAUDE.md

@@ -10,7 +10,7 @@
 
 ## Project Overview
 
-Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, Lidarr, Readarr, Whisparr and supported download clients like qBittorrent, Transmission, Deluge, and µTorrent. It provides malware protection, automated cleanup, and queue management for *arr applications.
+Cleanuparr is a tool for automating the cleanup of unwanted or blocked files in Sonarr, Radarr, Lidarr, Readarr, Whisparr and supported download clients like qBittorrent, Transmission, Deluge, µTorrent and rTorrent. It provides malware protection, automated cleanup, and queue management for *arr applications.
 
 **Key Features:**
 - Strike system for bad downloads

Cloudflare/static/known_malware_file_name_patterns

@@ -1,2 +0,0 @@
-thepirateheaven.org
-RARBG.work

README.md

@@ -49,6 +49,7 @@ https://cleanuparr.github.io/Cleanuparr/docs/screenshots
 - **Transmission**
 - **Deluge**
 - **µTorrent**
+- **rTorrent**
 
 ### Platforms
 - **Docker**
@@ -101,14 +102,6 @@ We welcome contributions from the community! Whether it's bug fixes, new feature
 - **[Feature Requests](https://github.com/Cleanuparr/Cleanuparr/issues/new/choose)** - Share your ideas for new features
 - **[Help Test Features](https://discord.gg/SCtMCgtsc4)** - Join Discord to test pre-release features and provide feedback
 
-# <img style="vertical-align: middle;" width="24px" src="./Logo/256.png" alt="Cleanuparr"> <span style="vertical-align: middle;">Cleanuparr</span> <img src="https://raw.githubusercontent.com/FortAwesome/Font-Awesome/6.x/svgs/solid/x.svg" height="24px" width="30px" style="vertical-align: middle;"> <span style="vertical-align: middle;">Huntarr</span> <img style="vertical-align: middle;" width="24px" src="https://github.com/plexguide/Huntarr.io/blob/main/frontend/static/logo/512.png?raw=true" alt Huntarr></img>
-
-Think of **Cleanuparr** as the janitor of your server; it keeps your download queue spotless, removes clutter, and blocks malicious files. Now imagine combining that with **Huntarr**, the compulsive librarian who finds missing and upgradable media to complete your collection
-
-While **Huntarr** fills in the blanks and improves what you already have, **Cleanuparr** makes sure that only clean downloads get through. If you're aiming for a reliable and self-sufficient setup, **Cleanuparr** and **Huntarr** will take your automated media stack to another level.
-
-<span style="font-size:24px"> ➡️ [**Huntarr**](https://github.com/plexguide/Huntarr.io) <span style="vertical-align: middle">![Huntarr](https://img.shields.io/github/stars/plexguide/Huntarr.io?style=social)</span></span> 
-
 # Credits
 Special thanks for inspiration go to:
 - [ThijmenGThN/swaparr](https://github.com/ThijmenGThN/swaparr)

code/backend/Cleanuparr.Api.Tests/Features/Auth/AuthControllerTests.cs

@@ -31,6 +31,16 @@ public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
         body.GetProperty("setupCompleted").GetBoolean().ShouldBeFalse();
     }
 
+    [Fact, TestPriority(0)]
+    public async Task AuthEndpoints_AlwaysReturnNoCacheHeaders()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.Headers.CacheControl.ShouldNotBeNull();
+        response.Headers.CacheControl!.NoCache.ShouldBeTrue();
+        response.Headers.CacheControl!.NoStore.ShouldBeTrue();
+    }
+
     [Fact, TestPriority(1)]
     public async Task Setup_CreateAccount_ReturnsCreated()
     {
@@ -178,6 +188,61 @@ public class AuthControllerTests : IClassFixture<CustomWebApplicationFactory>
         response.StatusCode.ShouldBe(HttpStatusCode.OK);
     }
 
+    [Fact, TestPriority(11)]
+    public async Task Setup_2FAGenerate_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/2fa/generate", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(12)]
+    public async Task Setup_PlexPin_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsync("/api/auth/setup/plex/pin", null);
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(13)]
+    public async Task Setup_Complete_AfterCompletion_IsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/setup/complete", new { });
+
+        // Blocked by middleware (403) or controller defense-in-depth (409)
+        new[] { HttpStatusCode.Forbidden, HttpStatusCode.Conflict }
+            .ShouldContain(response.StatusCode);
+    }
+
+    [Fact, TestPriority(14)]
+    public async Task Login_NotBlockedByMiddleware_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.PostAsJsonAsync("/api/auth/login", new
+        {
+            username = "admin",
+            password = "TestPassword123!"
+        });
+
+        // Login endpoint must NOT be blocked by the middleware (403).
+        // It may return OK (200) or TooManyRequests (429) due to brute force lockout from earlier tests.
+        response.StatusCode.ShouldNotBe(HttpStatusCode.Forbidden);
+    }
+
+    [Fact, TestPriority(15)]
+    public async Task AuthStatus_StillWorks_AfterSetupEndpointsBlocked()
+    {
+        var response = await _client.GetAsync("/api/auth/status");
+
+        response.StatusCode.ShouldBe(HttpStatusCode.OK);
+
+        var body = await response.Content.ReadFromJsonAsync<JsonElement>();
+        body.GetProperty("setupCompleted").GetBoolean().ShouldBeTrue();
+    }
+
     #region TOTP helpers
 
     private static string _totpSecret = "";

code/backend/Cleanuparr.Api.Tests/Features/SensitiveData/SensitiveDataHelperTests.cs

@@ -0,0 +1,78 @@
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.SensitiveData;
+
+public class SensitiveDataHelperTests
+{
+    [Fact]
+    public void IsPlaceholder_WithPlaceholder_ReturnsTrue()
+    {
+        SensitiveDataHelper.Placeholder.IsPlaceholder().ShouldBeTrue();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithAppriseStyledPlaceholder_ReturnsTrue()
+    {
+        $"discord://{SensitiveDataHelper.Placeholder}".IsPlaceholder().ShouldBeTrue();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithNull_ReturnsFalse()
+    {
+        ((string?)null).IsPlaceholder().ShouldBeFalse();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithEmptyString_ReturnsFalse()
+    {
+        "".IsPlaceholder().ShouldBeFalse();
+    }
+
+    [Fact]
+    public void IsPlaceholder_WithRealValue_ReturnsFalse()
+    {
+        "my-secret-api-key-123".IsPlaceholder().ShouldBeFalse();
+    }
+
+    [Theory]
+    [InlineData("discord://webhook_id/webhook_token", "discord://••••••••")]
+    [InlineData("slack://tokenA/tokenB/tokenC", "slack://••••••••")]
+    [InlineData("mailto://user:pass@gmail.com", "mailto://••••••••")]
+    [InlineData("json+http://user:pass@host/path", "json+http://••••••••")]
+    public void MaskAppriseUrls_SingleUrl_MasksCorrectly(string input, string expected)
+    {
+        SensitiveDataHelper.MaskAppriseUrls(input).ShouldBe(expected);
+    }
+
+    [Fact]
+    public void MaskAppriseUrls_MultipleUrls_MasksAll()
+    {
+        var input = "discord://token1 slack://tokenA/tokenB";
+        var result = SensitiveDataHelper.MaskAppriseUrls(input);
+
+        result.ShouldContain("discord://••••••••");
+        result.ShouldContain("slack://••••••••");
+        result.ShouldNotContain("token1");
+        result.ShouldNotContain("tokenA");
+    }
+
+    [Fact]
+    public void MaskAppriseUrls_MultilineUrls_MasksAll()
+    {
+        var input = "discord://token1\nslack://tokenA/tokenB";
+        var result = SensitiveDataHelper.MaskAppriseUrls(input);
+
+        result.ShouldContain("discord://••••••••");
+        result.ShouldContain("slack://••••••••");
+    }
+
+    [Theory]
+    [InlineData(null)]
+    [InlineData("")]
+    [InlineData("   ")]
+    public void MaskAppriseUrls_EmptyOrNull_ReturnsAsIs(string? input)
+    {
+        SensitiveDataHelper.MaskAppriseUrls(input).ShouldBe(input);
+    }
+}

code/backend/Cleanuparr.Api.Tests/Features/SensitiveData/SensitiveDataInputTests.cs

@@ -0,0 +1,317 @@
+using Cleanuparr.Api.Features.Arr.Contracts.Requests;
+using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
+
+namespace Cleanuparr.Api.Tests.Features.SensitiveData;
+
+/// <summary>
+/// Tests that placeholder values are correctly handled on the input side:
+/// - UPDATE operations preserve the existing DB value when a placeholder is sent
+/// - CREATE operations reject placeholder values
+/// - TEST operations reject placeholder values
+/// </summary>
+public class SensitiveDataInputTests
+{
+    private const string Placeholder = SensitiveDataHelper.Placeholder;
+
+    #region ArrInstanceRequest — UPDATE
+
+    [Fact]
+    public void ArrInstanceRequest_ApplyTo_WithPlaceholderApiKey_PreservesExistingValue()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Updated Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+        };
+
+        var existingInstance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "original-secret-key",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4,
+        };
+
+        request.ApplyTo(existingInstance);
+
+        existingInstance.ApiKey.ShouldBe("original-secret-key");
+        existingInstance.Name.ShouldBe("Updated Sonarr");
+    }
+
+    [Fact]
+    public void ArrInstanceRequest_ApplyTo_WithRealApiKey_UpdatesValue()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = "brand-new-api-key",
+            Version = 4,
+        };
+
+        var existingInstance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "original-secret-key",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4,
+        };
+
+        request.ApplyTo(existingInstance);
+
+        existingInstance.ApiKey.ShouldBe("brand-new-api-key");
+    }
+
+    #endregion
+
+    #region ArrInstanceRequest — CREATE
+
+    [Fact]
+    public void ArrInstanceRequest_ToEntity_WithPlaceholderApiKey_ThrowsValidationException()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+        };
+
+        Should.Throw<ValidationException>(() => request.ToEntity(Guid.NewGuid()));
+    }
+
+    [Fact]
+    public void ArrInstanceRequest_ToEntity_WithRealApiKey_Succeeds()
+    {
+        var request = new ArrInstanceRequest
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = "real-api-key-123",
+            Version = 4,
+        };
+
+        var entity = request.ToEntity(Guid.NewGuid());
+        entity.ApiKey.ShouldBe("real-api-key-123");
+    }
+
+    #endregion
+
+    #region TestArrInstanceRequest — TEST
+
+    [Fact]
+    public void TestArrInstanceRequest_ToTestInstance_WithPlaceholderApiKey_AndNoResolvedKey_ThrowsValidationException()
+    {
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+        };
+
+        Should.Throw<ValidationException>(() => request.ToTestInstance());
+    }
+
+    [Fact]
+    public void TestArrInstanceRequest_ToTestInstance_WithPlaceholderApiKey_AndResolvedKey_UsesResolvedKey()
+    {
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr:8989",
+            ApiKey = Placeholder,
+            Version = 4,
+            InstanceId = Guid.NewGuid(),
+        };
+
+        var instance = request.ToTestInstance("resolved-api-key-from-db");
+        instance.ApiKey.ShouldBe("resolved-api-key-from-db");
+    }
+
+    [Fact]
+    public void TestArrInstanceRequest_ToTestInstance_WithRealApiKey_Succeeds()
+    {
+        var request = new TestArrInstanceRequest
+        {
+            Url = "http://sonarr:8989",
+            ApiKey = "real-api-key",
+            Version = 4,
+        };
+
+        var instance = request.ToTestInstance();
+        instance.ApiKey.ShouldBe("real-api-key");
+    }
+
+    #endregion
+
+    #region UpdateDownloadClientRequest — UPDATE
+
+    [Fact]
+    public void UpdateDownloadClientRequest_ApplyTo_WithPlaceholderPassword_PreservesExistingValue()
+    {
+        var request = new UpdateDownloadClientRequest
+        {
+            Name = "Updated qBit",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Username = "admin",
+            Password = Placeholder,
+        };
+
+        var existing = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "original-secret-password",
+        };
+
+        var result = request.ApplyTo(existing);
+
+        result.Password.ShouldBe("original-secret-password");
+        result.Name.ShouldBe("Updated qBit");
+    }
+
+    [Fact]
+    public void UpdateDownloadClientRequest_ApplyTo_WithRealPassword_UpdatesValue()
+    {
+        var request = new UpdateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Username = "admin",
+            Password = "new-password-123",
+        };
+
+        var existing = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "original-secret-password",
+        };
+
+        var result = request.ApplyTo(existing);
+
+        result.Password.ShouldBe("new-password-123");
+    }
+
+    #endregion
+
+    #region CreateDownloadClientRequest — CREATE
+
+    [Fact]
+    public void CreateDownloadClientRequest_Validate_WithPlaceholderPassword_ThrowsValidationException()
+    {
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = Placeholder,
+        };
+
+        Should.Throw<ValidationException>(() => request.Validate());
+    }
+
+    [Fact]
+    public void CreateDownloadClientRequest_Validate_WithRealPassword_Succeeds()
+    {
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = "real-password",
+        };
+
+        Should.NotThrow(() => request.Validate());
+    }
+
+    [Fact]
+    public void CreateDownloadClientRequest_Validate_WithNullPassword_Succeeds()
+    {
+        var request = new CreateDownloadClientRequest
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = null,
+        };
+
+        Should.NotThrow(() => request.Validate());
+    }
+
+    #endregion
+
+    #region TestDownloadClientRequest — TEST
+
+    [Fact]
+    public void TestDownloadClientRequest_ToTestConfig_WithPlaceholderPassword_AndNoResolvedPassword_ThrowsValidationException()
+    {
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = Placeholder,
+        };
+
+        request.Validate();
+        Should.Throw<ValidationException>(() => request.ToTestConfig());
+    }
+
+    [Fact]
+    public void TestDownloadClientRequest_ToTestConfig_WithPlaceholderPassword_AndResolvedPassword_UsesResolvedPassword()
+    {
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = Placeholder,
+            ClientId = Guid.NewGuid(),
+        };
+
+        request.Validate();
+        var config = request.ToTestConfig("resolved-password-from-db");
+        config.Password.ShouldBe("resolved-password-from-db");
+    }
+
+    [Fact]
+    public void TestDownloadClientRequest_ToTestConfig_WithRealPassword_Succeeds()
+    {
+        var request = new TestDownloadClientRequest
+        {
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = "http://qbit:8080",
+            Password = "real-password",
+        };
+
+        request.Validate();
+        var config = request.ToTestConfig();
+        config.Password.ShouldBe("real-password");
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api.Tests/Features/SensitiveData/SensitiveDataResolverTests.cs

@@ -0,0 +1,461 @@
+using System.Text.Json;
+using System.Text.Json.Serialization.Metadata;
+using Cleanuparr.Api.Json;
+using Cleanuparr.Domain.Enums;
+using Cleanuparr.Infrastructure.Features.Arr.Dtos;
+using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Persistence.Models.Configuration.Notification;
+using Cleanuparr.Shared.Helpers;
+using Shouldly;
+
+namespace Cleanuparr.Api.Tests.Features.SensitiveData;
+
+/// <summary>
+/// Tests that the SensitiveDataResolver correctly masks all [SensitiveData] properties
+/// during JSON serialization — this is what controls the API response output.
+/// </summary>
+public class SensitiveDataResolverTests
+{
+    private readonly JsonSerializerOptions _options;
+    private const string Placeholder = SensitiveDataHelper.Placeholder;
+
+    public SensitiveDataResolverTests()
+    {
+        _options = new JsonSerializerOptions
+        {
+            TypeInfoResolver = new SensitiveDataResolver(new DefaultJsonTypeInfoResolver()),
+            PropertyNamingPolicy = JsonNamingPolicy.CamelCase,
+        };
+    }
+
+    #region ArrInstance
+
+    [Fact]
+    public void ArrInstance_ApiKey_IsMasked()
+    {
+        var instance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ApiKey = "super-secret-api-key-12345",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4
+        };
+
+        var json = JsonSerializer.Serialize(instance, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+    }
+
+    [Fact]
+    public void ArrInstance_NonSensitiveFields_AreVisible()
+    {
+        var instance = new ArrInstance
+        {
+            Name = "Sonarr",
+            Url = new Uri("http://sonarr:8989"),
+            ExternalUrl = new Uri("https://sonarr.example.com"),
+            ApiKey = "super-secret-api-key-12345",
+            ArrConfigId = Guid.NewGuid(),
+            Version = 4
+        };
+
+        var json = JsonSerializer.Serialize(instance, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("name").GetString().ShouldBe("Sonarr");
+        doc.RootElement.GetProperty("url").GetString().ShouldBe("http://sonarr:8989");
+        doc.RootElement.GetProperty("externalUrl").GetString().ShouldBe("https://sonarr.example.com");
+    }
+
+    [Fact]
+    public void ArrInstance_NullApiKey_RemainsNull()
+    {
+        // ApiKey is required, but let's test with the DTO which might handle null
+        var dto = new ArrInstanceDto
+        {
+            Name = "Sonarr",
+            Url = "http://sonarr:8989",
+            ApiKey = null!,
+            Version = 4
+        };
+
+        var json = JsonSerializer.Serialize(dto, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region ArrInstanceDto
+
+    [Fact]
+    public void ArrInstanceDto_ApiKey_IsMasked()
+    {
+        var dto = new ArrInstanceDto
+        {
+            Id = Guid.NewGuid(),
+            Name = "Radarr",
+            Url = "http://radarr:7878",
+            ApiKey = "dto-secret-api-key-67890",
+            Version = 5
+        };
+
+        var json = JsonSerializer.Serialize(dto, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("name").GetString().ShouldBe("Radarr");
+        doc.RootElement.GetProperty("url").GetString().ShouldBe("http://radarr:7878");
+    }
+
+    #endregion
+
+    #region DownloadClientConfig
+
+    [Fact]
+    public void DownloadClientConfig_Password_IsMasked()
+    {
+        var config = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "my-secret-password",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").GetString().ShouldBe(Placeholder);
+    }
+
+    [Fact]
+    public void DownloadClientConfig_Username_IsVisible()
+    {
+        var config = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+            Username = "admin",
+            Password = "my-secret-password",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("admin");
+        doc.RootElement.GetProperty("name").GetString().ShouldBe("qBittorrent");
+    }
+
+    [Fact]
+    public void DownloadClientConfig_NullPassword_RemainsNull()
+    {
+        var config = new DownloadClientConfig
+        {
+            Name = "qBittorrent",
+            TypeName = DownloadClientTypeName.qBittorrent,
+            Type = DownloadClientType.Torrent,
+            Host = new Uri("http://qbit:8080"),
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region NotifiarrConfig
+
+    [Fact]
+    public void NotifiarrConfig_ApiKey_IsMasked()
+    {
+        var config = new NotifiarrConfig
+        {
+            ApiKey = "notifiarr-api-key-secret",
+            ChannelId = "123456789"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("channelId").GetString().ShouldBe("123456789");
+    }
+
+    #endregion
+
+    #region DiscordConfig
+
+    [Fact]
+    public void DiscordConfig_WebhookUrl_IsMasked()
+    {
+        var config = new DiscordConfig
+        {
+            WebhookUrl = "https://discord.com/api/webhooks/123456/secret-token",
+            Username = "Cleanuparr Bot",
+            AvatarUrl = "https://example.com/avatar.png"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("webhookUrl").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("Cleanuparr Bot");
+        doc.RootElement.GetProperty("avatarUrl").GetString().ShouldBe("https://example.com/avatar.png");
+    }
+
+    #endregion
+
+    #region TelegramConfig
+
+    [Fact]
+    public void TelegramConfig_BotToken_IsMasked()
+    {
+        var config = new TelegramConfig
+        {
+            BotToken = "1234567890:ABCdefGHIjklmnoPQRstuvWXyz",
+            ChatId = "-1001234567890",
+            TopicId = "42",
+            SendSilently = true
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("botToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("chatId").GetString().ShouldBe("-1001234567890");
+        doc.RootElement.GetProperty("topicId").GetString().ShouldBe("42");
+    }
+
+    #endregion
+
+    #region NtfyConfig
+
+    [Fact]
+    public void NtfyConfig_PasswordAndAccessToken_AreMasked()
+    {
+        var config = new NtfyConfig
+        {
+            ServerUrl = "https://ntfy.example.com",
+            Topics = ["test-topic"],
+            AuthenticationType = NtfyAuthenticationType.BasicAuth,
+            Username = "ntfy-user",
+            Password = "ntfy-secret-password",
+            AccessToken = "ntfy-access-token-secret",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("accessToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("serverUrl").GetString().ShouldBe("https://ntfy.example.com");
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("ntfy-user");
+    }
+
+    [Fact]
+    public void NtfyConfig_NullPasswordAndAccessToken_RemainNull()
+    {
+        var config = new NtfyConfig
+        {
+            ServerUrl = "https://ntfy.example.com",
+            Topics = ["test-topic"],
+            AuthenticationType = NtfyAuthenticationType.None,
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("password").ValueKind.ShouldBe(JsonValueKind.Null);
+        doc.RootElement.GetProperty("accessToken").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region PushoverConfig
+
+    [Fact]
+    public void PushoverConfig_ApiTokenAndUserKey_AreMasked()
+    {
+        var config = new PushoverConfig
+        {
+            ApiToken = "pushover-api-token-secret",
+            UserKey = "pushover-user-key-secret",
+            Priority = PushoverPriority.Normal,
+            Devices = ["iphone", "desktop"]
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("userKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("devices").GetArrayLength().ShouldBe(2);
+    }
+
+    #endregion
+
+    #region GotifyConfig
+
+    [Fact]
+    public void GotifyConfig_ApplicationToken_IsMasked()
+    {
+        var config = new GotifyConfig
+        {
+            ServerUrl = "https://gotify.example.com",
+            ApplicationToken = "gotify-app-token-secret",
+            Priority = 5
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("applicationToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("serverUrl").GetString().ShouldBe("https://gotify.example.com");
+    }
+
+    #endregion
+
+    #region AppriseConfig
+
+    [Fact]
+    public void AppriseConfig_Key_IsMasked_WithFullMask()
+    {
+        var config = new AppriseConfig
+        {
+            Mode = AppriseMode.Api,
+            Url = "https://apprise.example.com",
+            Key = "apprise-config-key-secret",
+            Tags = "urgent",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("key").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("url").GetString().ShouldBe("https://apprise.example.com");
+    }
+
+    [Fact]
+    public void AppriseConfig_ServiceUrls_IsMasked_WithAppriseUrlMask()
+    {
+        var config = new AppriseConfig
+        {
+            Mode = AppriseMode.Cli,
+            ServiceUrls = "discord://webhook_id/webhook_token slack://tokenA/tokenB/tokenC"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        var maskedUrls = doc.RootElement.GetProperty("serviceUrls").GetString();
+        maskedUrls.ShouldContain("discord://••••••••");
+        maskedUrls.ShouldContain("slack://••••••••");
+        maskedUrls.ShouldNotContain("webhook_id");
+        maskedUrls.ShouldNotContain("webhook_token");
+        maskedUrls.ShouldNotContain("tokenA");
+    }
+
+    [Fact]
+    public void AppriseConfig_NullServiceUrls_RemainsNull()
+    {
+        var config = new AppriseConfig
+        {
+            Mode = AppriseMode.Api,
+            Url = "https://apprise.example.com",
+            Key = "some-key",
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("serviceUrls").ValueKind.ShouldBe(JsonValueKind.Null);
+    }
+
+    #endregion
+
+    #region Polymorphic serialization (as used in NotificationProviderResponse)
+
+    [Fact]
+    public void PolymorphicSerialization_NotifiarrConfig_StillMasked()
+    {
+        // The notification providers endpoint casts configs to `object`.
+        // Verify that the resolver still masks when serializing as a concrete type at runtime.
+        object config = new NotifiarrConfig
+        {
+            ApiKey = "my-secret-notifiarr-key",
+            ChannelId = "987654321"
+        };
+
+        var json = JsonSerializer.Serialize(config, config.GetType(), _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("channelId").GetString().ShouldBe("987654321");
+    }
+
+    [Fact]
+    public void PolymorphicSerialization_DiscordConfig_StillMasked()
+    {
+        object config = new DiscordConfig
+        {
+            WebhookUrl = "https://discord.com/api/webhooks/123/secret",
+            Username = "Bot"
+        };
+
+        var json = JsonSerializer.Serialize(config, config.GetType(), _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("webhookUrl").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("username").GetString().ShouldBe("Bot");
+    }
+
+    #endregion
+
+    #region Edge cases
+
+    [Fact]
+    public void EmptySensitiveString_IsMasked_NotReturnedEmpty()
+    {
+        var config = new NotifiarrConfig
+        {
+            ApiKey = "",
+            ChannelId = "123"
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        // Even empty strings get masked to the placeholder
+        doc.RootElement.GetProperty("apiKey").GetString().ShouldBe(Placeholder);
+    }
+
+    [Fact]
+    public void MultipleSensitiveFields_AllMasked()
+    {
+        var config = new PushoverConfig
+        {
+            ApiToken = "token-abc-123",
+            UserKey = "user-key-xyz-789",
+            Priority = PushoverPriority.High,
+        };
+
+        var json = JsonSerializer.Serialize(config, _options);
+        var doc = JsonDocument.Parse(json);
+
+        doc.RootElement.GetProperty("apiToken").GetString().ShouldBe(Placeholder);
+        doc.RootElement.GetProperty("userKey").GetString().ShouldBe(Placeholder);
+    }
+
+    #endregion
+}

code/backend/Cleanuparr.Api/Auth/TrustedNetworkAuthenticationHandler.cs

@@ -0,0 +1,192 @@
+using System.Net;
+using System.Security.Claims;
+using System.Text.Encodings.Web;
+using Cleanuparr.Infrastructure.Extensions;
+using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authentication;
+using Microsoft.EntityFrameworkCore;
+using Microsoft.Extensions.Options;
+
+namespace Cleanuparr.Api.Auth;
+
+public static class TrustedNetworkAuthenticationDefaults
+{
+    public const string AuthenticationScheme = "TrustedNetwork";
+}
+
+public class TrustedNetworkAuthenticationHandler : AuthenticationHandler<AuthenticationSchemeOptions>
+{
+    public TrustedNetworkAuthenticationHandler(
+        IOptionsMonitor<AuthenticationSchemeOptions> options,
+        ILoggerFactory logger,
+        UrlEncoder encoder)
+        : base(options, logger, encoder)
+    {
+    }
+
+    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
+    {
+        // Load auth config from database
+        await using var dataContext = DataContext.CreateStaticInstance();
+        var config = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+
+        if (config is null || !config.Auth.DisableAuthForLocalAddresses)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Determine client IP
+        var clientIp = GetClientIp(config.Auth.TrustForwardedHeaders);
+        if (clientIp is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Check if the client IP is trusted
+        if (!IsTrustedAddress(clientIp, config.Auth.TrustedNetworks))
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        // Load the admin user
+        await using var usersContext = UsersContext.CreateStaticInstance();
+        var user = await usersContext.Users
+            .AsNoTracking()
+            .FirstOrDefaultAsync(u => u.SetupCompleted);
+
+        if (user is null)
+        {
+            return AuthenticateResult.NoResult();
+        }
+
+        var claims = new[]
+        {
+            new Claim(ClaimTypes.NameIdentifier, user.Id.ToString()),
+            new Claim(ClaimTypes.Name, user.Username),
+            new Claim("auth_method", "trusted_network")
+        };
+
+        var identity = new ClaimsIdentity(claims, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+        var principal = new ClaimsPrincipal(identity);
+        var ticket = new AuthenticationTicket(principal, TrustedNetworkAuthenticationDefaults.AuthenticationScheme);
+
+        return AuthenticateResult.Success(ticket);
+    }
+
+    private IPAddress? GetClientIp(bool trustForwardedHeaders) =>
+        ResolveClientIp(Context, trustForwardedHeaders);
+
+    public static IPAddress? ResolveClientIp(HttpContext httpContext, bool trustForwardedHeaders)
+    {
+        var remoteIp = httpContext.Connection.RemoteIpAddress;
+        if (remoteIp is null)
+        {
+            return null;
+        }
+
+        // Only trust forwarded headers if the direct connection is from a local address
+        if (trustForwardedHeaders && remoteIp.IsLocalAddress())
+        {
+            // Check X-Forwarded-For first, then X-Real-IP
+            var forwardedFor = httpContext.Request.Headers["X-Forwarded-For"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(forwardedFor))
+            {
+                // X-Forwarded-For can contain multiple IPs: client, proxy1, proxy2
+                // The first one is the original client
+                var firstIp = forwardedFor.Split(',')[0].Trim();
+                if (IPAddress.TryParse(firstIp, out var parsedIp))
+                {
+                    return parsedIp;
+                }
+            }
+
+            var realIp = httpContext.Request.Headers["X-Real-IP"].FirstOrDefault();
+            if (!string.IsNullOrEmpty(realIp) && IPAddress.TryParse(realIp, out var realParsedIp))
+            {
+                return realParsedIp;
+            }
+        }
+
+        return remoteIp;
+    }
+
+    public static bool IsTrustedAddress(IPAddress clientIp, List<string> trustedNetworks)
+    {
+        // Normalize IPv4-mapped IPv6 addresses
+        if (clientIp.IsIPv4MappedToIPv6)
+        {
+            clientIp = clientIp.MapToIPv4();
+        }
+
+        // Check if it's a local address (built-in ranges)
+        if (clientIp.IsLocalAddress())
+        {
+            return true;
+        }
+
+        // Check against custom trusted networks
+        foreach (var network in trustedNetworks)
+        {
+            if (MatchesCidr(clientIp, network))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    public static bool MatchesCidr(IPAddress address, string cidr)
+    {
+        if (cidr.Contains('/'))
+        {
+            var parts = cidr.Split('/');
+            if (!IPAddress.TryParse(parts[0], out var networkAddress) ||
+                !int.TryParse(parts[1], out var prefixLength))
+            {
+                return false;
+            }
+
+            // Normalize both addresses
+            if (networkAddress.IsIPv4MappedToIPv6)
+                networkAddress = networkAddress.MapToIPv4();
+            if (address.IsIPv4MappedToIPv6)
+                address = address.MapToIPv4();
+
+            // Must be same address family
+            if (address.AddressFamily != networkAddress.AddressFamily)
+                return false;
+
+            var addressBytes = address.GetAddressBytes();
+            var networkBytes = networkAddress.GetAddressBytes();
+
+            // Compare bytes up to prefix length
+            var fullBytes = prefixLength / 8;
+            var remainingBits = prefixLength % 8;
+
+            for (var i = 0; i < fullBytes && i < addressBytes.Length; i++)
+            {
+                if (addressBytes[i] != networkBytes[i])
+                    return false;
+            }
+
+            if (remainingBits > 0 && fullBytes < addressBytes.Length)
+            {
+                var mask = (byte)(0xFF << (8 - remainingBits));
+                if ((addressBytes[fullBytes] & mask) != (networkBytes[fullBytes] & mask))
+                    return false;
+            }
+
+            return true;
+        }
+
+        // Plain IP match
+        if (!IPAddress.TryParse(cidr, out var singleIp))
+            return false;
+
+        if (singleIp.IsIPv4MappedToIPv6)
+            singleIp = singleIp.MapToIPv4();
+
+        return address.Equals(singleIp);
+    }
+}

code/backend/Cleanuparr.Api/Controllers/ApiDocumentationController.cs

@@ -1,9 +1,11 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api")]
+[Authorize]
 public class ApiDocumentationController : ControllerBase
 {
     [HttpGet]

code/backend/Cleanuparr.Api/Controllers/EventsController.cs

@@ -2,6 +2,7 @@ using System.Text.Json.Serialization;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Events;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -9,6 +10,7 @@ namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class EventsController : ControllerBase
 {
     private readonly EventsContext _context;

code/backend/Cleanuparr.Api/Controllers/HealthCheckController.cs

@@ -1,4 +1,5 @@
 using Cleanuparr.Infrastructure.Health;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Cleanuparr.Api.Controllers;
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 /// </summary>
 [ApiController]
 [Route("api/health")]
+[Authorize]
 public class HealthCheckController : ControllerBase
 {
     private readonly ILogger<HealthCheckController> _logger;

code/backend/Cleanuparr.Api/Controllers/HealthController.cs

@@ -1,3 +1,4 @@
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.Extensions.Diagnostics.HealthChecks;
 
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 /// </summary>
 [ApiController]
 [Route("[controller]")]
+[Authorize]
 public class HealthController : ControllerBase
 {
     private readonly HealthCheckService _healthCheckService;
@@ -23,6 +25,7 @@ public class HealthController : ControllerBase
     /// Basic liveness probe - checks if the application is running
     /// Used by Docker HEALTHCHECK and Kubernetes liveness probes
     /// </summary>
+    [AllowAnonymous]
     [HttpGet]
     [Route("/health")]
     public async Task<IActionResult> GetHealth()
@@ -47,6 +50,7 @@ public class HealthController : ControllerBase
     /// Readiness probe - checks if the application is ready to serve traffic
     /// Used by Kubernetes readiness probes
     /// </summary>
+    [AllowAnonymous]
     [HttpGet]
     [Route("/health/ready")]
     public async Task<IActionResult> GetReadiness()

code/backend/Cleanuparr.Api/Controllers/JobsController.cs

@@ -2,12 +2,14 @@ using Cleanuparr.Api.Models;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Models;
 using Cleanuparr.Infrastructure.Services.Interfaces;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class JobsController : ControllerBase
 {
     private readonly IJobManagementService _jobManagementService;

code/backend/Cleanuparr.Api/Controllers/ManualEventsController.cs

@@ -1,6 +1,7 @@
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Events;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class ManualEventsController : ControllerBase
 {
     private readonly EventsContext _context;

code/backend/Cleanuparr.Api/Controllers/StatsController.cs

@@ -1,4 +1,5 @@
 using Cleanuparr.Infrastructure.Stats;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 
 namespace Cleanuparr.Api.Controllers;
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 /// </summary>
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class StatsController : ControllerBase
 {
     private readonly ILogger<StatsController> _logger;

code/backend/Cleanuparr.Api/Controllers/StatusController.cs

@@ -2,6 +2,7 @@ using System.Diagnostics;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -9,6 +10,7 @@ namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class StatusController : ControllerBase
 {
     private readonly ILogger<StatusController> _logger;

code/backend/Cleanuparr.Api/Controllers/StrikesController.cs

@@ -1,6 +1,7 @@
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.State;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -8,6 +9,7 @@ namespace Cleanuparr.Api.Controllers;
 
 [ApiController]
 [Route("api/[controller]")]
+[Authorize]
 public class StrikesController : ControllerBase
 {
     private readonly EventsContext _context;

code/backend/Cleanuparr.Api/DependencyInjection/ApiDI.cs

@@ -1,4 +1,7 @@
 using System.Text.Json.Serialization;
+using System.Text.Json.Serialization.Metadata;
+using Cleanuparr.Api.Filters;
+using Cleanuparr.Api.Json;
 using Cleanuparr.Infrastructure.Health;
 using Cleanuparr.Infrastructure.Hubs;
 using Microsoft.AspNetCore.Http.Json;
@@ -17,12 +20,14 @@ public static class ApiDI
             options.SerializerOptions.PropertyNameCaseInsensitive = true;
             options.SerializerOptions.Converters.Add(new JsonStringEnumConverter());
             options.SerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
+            options.SerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
+                options.SerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
         });
-        
+
         // Make JsonSerializerOptions available for injection
         services.AddSingleton(sp =>
             sp.GetRequiredService<IOptions<JsonOptions>>().Value.SerializerOptions);
-        
+
         // Add API-specific services
         services
             .AddControllers()
@@ -31,9 +36,11 @@ public static class ApiDI
                 options.JsonSerializerOptions.PropertyNameCaseInsensitive = true;
                 options.JsonSerializerOptions.Converters.Add(new JsonStringEnumConverter());
                 options.JsonSerializerOptions.ReferenceHandler = ReferenceHandler.IgnoreCycles;
+                options.JsonSerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
+                    options.JsonSerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
             });
         services.AddEndpointsApiExplorer();
-        
+
         // Add SignalR for real-time updates
         services
             .AddSignalR()
@@ -41,6 +48,8 @@ public static class ApiDI
             {
                 options.PayloadSerializerOptions.PropertyNameCaseInsensitive = true;
                 options.PayloadSerializerOptions.Converters.Add(new JsonStringEnumConverter());
+                options.PayloadSerializerOptions.TypeInfoResolver = new SensitiveDataResolver(
+                    options.PayloadSerializerOptions.TypeInfoResolver ?? new DefaultJsonTypeInfoResolver());
             });
         
         // Add health status broadcaster
@@ -56,10 +65,10 @@ public static class ApiDI
         // Enable compression
         app.UseResponseCompression();
         
-        // Serve static files with caching
+        // Serve static files without caching
         app.UseStaticFiles(new StaticFileOptions
         {
-            OnPrepareResponse = _ => {}
+            OnPrepareResponse = ctx => NoCacheAttribute.Apply(ctx.Context.Response.Headers)
         });
         
         // Add the global exception handling middleware first
@@ -111,6 +120,7 @@ public static class ApiDI
             );
             
             context.Response.ContentType = "text/html";
+            NoCacheAttribute.Apply(context.Response.Headers);
             await context.Response.WriteAsync(indexContent, Encoding.UTF8);
         }).AllowAnonymous();
         

code/backend/Cleanuparr.Api/DependencyInjection/AuthDI.cs

@@ -29,7 +29,16 @@ public static class AuthDI
                         return ApiKeyAuthenticationDefaults.AuthenticationScheme;
                     }
 
-                    return JwtBearerDefaults.AuthenticationScheme;
+                    // Check for Bearer token or SignalR access_token
+                    if (context.Request.Headers.ContainsKey("Authorization") ||
+                        (context.Request.Path.StartsWithSegments("/api/hubs") &&
+                         context.Request.Query.ContainsKey("access_token")))
+                    {
+                        return JwtBearerDefaults.AuthenticationScheme;
+                    }
+
+                    // Fall through to trusted network handler (returns NoResult if disabled)
+                    return TrustedNetworkAuthenticationDefaults.AuthenticationScheme;
                 };
             })
             .AddJwtBearer(options =>
@@ -64,7 +73,9 @@ public static class AuthDI
                 };
             })
             .AddScheme<AuthenticationSchemeOptions, ApiKeyAuthenticationHandler>(
-                ApiKeyAuthenticationDefaults.AuthenticationScheme, _ => { });
+                ApiKeyAuthenticationDefaults.AuthenticationScheme, _ => { })
+            .AddScheme<AuthenticationSchemeOptions, TrustedNetworkAuthenticationHandler>(
+                TrustedNetworkAuthenticationDefaults.AuthenticationScheme, _ => { });
 
         services.AddAuthorization(options =>
         {

code/backend/Cleanuparr.Api/Features/Arr/Contracts/Requests/ArrInstanceRequest.cs

@@ -1,7 +1,9 @@
 using System;
 using System.ComponentModel.DataAnnotations;
 
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
 using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.Arr.Contracts.Requests;
 
@@ -23,16 +25,24 @@ public sealed record ArrInstanceRequest
 
     public string? ExternalUrl { get; init; }
 
-    public ArrInstance ToEntity(Guid configId) => new()
+    public ArrInstance ToEntity(Guid configId)
     {
-        Enabled = Enabled,
-        Name = Name,
-        Url = new Uri(Url),
-        ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null,
-        ApiKey = ApiKey,
-        ArrConfigId = configId,
-        Version = Version,
-    };
+        if (ApiKey.IsPlaceholder())
+        {
+            throw new ValidationException("API key is required when creating a new instance");
+        }
+
+        return new()
+        {
+            Enabled = Enabled,
+            Name = Name,
+            Url = new Uri(Url),
+            ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null,
+            ApiKey = ApiKey,
+            ArrConfigId = configId,
+            Version = Version,
+        };
+    }
 
     public void ApplyTo(ArrInstance instance)
     {
@@ -40,7 +50,7 @@ public sealed record ArrInstanceRequest
         instance.Name = Name;
         instance.Url = new Uri(Url);
         instance.ExternalUrl = ExternalUrl is not null ? new Uri(ExternalUrl) : null;
-        instance.ApiKey = ApiKey;
+        instance.ApiKey = ApiKey.IsPlaceholder() ? instance.ApiKey : ApiKey;
         instance.Version = Version;
     }
 }

code/backend/Cleanuparr.Api/Features/Arr/Contracts/Requests/TestArrInstanceRequest.cs

@@ -1,7 +1,9 @@
 using System;
 using System.ComponentModel.DataAnnotations;
 
+using ValidationException = Cleanuparr.Domain.Exceptions.ValidationException;
 using Cleanuparr.Persistence.Models.Configuration.Arr;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.Arr.Contracts.Requests;
 
@@ -12,17 +14,29 @@ public sealed record TestArrInstanceRequest
 
     [Required]
     public required string ApiKey { get; init; }
-    
+
     [Required]
     public required float Version { get; init; }
 
-    public ArrInstance ToTestInstance() => new()
+    public Guid? InstanceId { get; init; }
+
+    public ArrInstance ToTestInstance(string? resolvedApiKey = null)
     {
-        Enabled = true,
-        Name = "Test Instance",
-        Url = new Uri(Url),
-        ApiKey = ApiKey,
-        ArrConfigId = Guid.Empty,
-        Version = Version,
-    };
+        var apiKey = resolvedApiKey ?? ApiKey;
+
+        if (apiKey.IsPlaceholder())
+        {
+            throw new ValidationException("API key cannot be a placeholder value");
+        }
+
+        return new()
+        {
+            Enabled = true,
+            Name = "Test Instance",
+            Url = new Uri(Url),
+            ApiKey = apiKey,
+            ArrConfigId = Guid.Empty,
+            Version = Version,
+        };
+    }
 }

code/backend/Cleanuparr.Api/Features/Arr/Controllers/ArrConfigController.cs

@@ -3,7 +3,9 @@ using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Features.Arr.Dtos;
 using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
 using Cleanuparr.Persistence;
+using Cleanuparr.Shared.Helpers;
 using Mapster;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -11,6 +13,7 @@ namespace Cleanuparr.Api.Features.Arr.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class ArrConfigController : ControllerBase
 {
     private readonly ILogger<ArrConfigController> _logger;
@@ -282,7 +285,23 @@ public sealed class ArrConfigController : ControllerBase
     {
         try
         {
-            var testInstance = request.ToTestInstance();
+            string? resolvedApiKey = null;
+
+            if (request.ApiKey.IsPlaceholder() && request.InstanceId.HasValue)
+            {
+                var existingInstance = await _dataContext.ArrInstances
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(i => i.Id == request.InstanceId.Value);
+
+                if (existingInstance is null)
+                {
+                    return NotFound($"Instance with ID {request.InstanceId.Value} not found");
+                }
+
+                resolvedApiKey = existingInstance.ApiKey;
+            }
+
+            var testInstance = request.ToTestInstance(resolvedApiKey);
             var client = _arrClientFactory.GetClient(type, request.Version);
             await client.HealthCheckAsync(testInstance);
 

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Disable2faRequest.cs

@@ -0,0 +1,13 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Disable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+
+    [Required]
+    [StringLength(6, MinimumLength = 6)]
+    public required string TotpCode { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Requests/Enable2faRequest.cs

@@ -0,0 +1,9 @@
+using System.ComponentModel.DataAnnotations;
+
+namespace Cleanuparr.Api.Features.Auth.Contracts.Requests;
+
+public sealed record Enable2faRequest
+{
+    [Required]
+    public required string Password { get; init; }
+}

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/AuthStatusResponse.cs

@@ -4,4 +4,5 @@ public sealed record AuthStatusResponse
 {
     public required bool SetupCompleted { get; init; }
     public bool PlexLinked { get; init; }
+    public bool AuthBypassActive { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Auth/Contracts/Responses/LoginResponse.cs

@@ -4,4 +4,5 @@ public sealed record LoginResponse
 {
     public required bool RequiresTwoFactor { get; init; }
     public string? LoginToken { get; init; }
+    public TokenResponse? Tokens { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AccountController.cs

@@ -2,6 +2,7 @@ using System.Security.Claims;
 using System.Security.Cryptography;
 using Cleanuparr.Api.Features.Auth.Contracts.Requests;
 using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Api.Filters;
 using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Auth;
@@ -14,6 +15,7 @@ namespace Cleanuparr.Api.Features.Auth.Controllers;
 [ApiController]
 [Route("api/account")]
 [Authorize]
+[NoCache]
 public sealed class AccountController : ControllerBase
 {
     private readonly UsersContext _usersContext;
@@ -66,8 +68,21 @@ public sealed class AccountController : ControllerBase
                 return BadRequest(new { error = "Current password is incorrect" });
             }
 
+            DateTime now = DateTime.UtcNow;
+
             user.PasswordHash = _passwordService.HashPassword(request.NewPassword);
-            user.UpdatedAt = DateTime.UtcNow;
+            user.UpdatedAt = now;
+
+            // Revoke all existing refresh tokens so old sessions can't be reused
+            var activeTokens = await _usersContext.RefreshTokens
+                .Where(r => r.UserId == user.Id && r.RevokedAt == null)
+                .ToListAsync();
+
+            foreach (var token in activeTokens)
+            {
+                token.RevokedAt = now;
+            }
+
             await _usersContext.SaveChangesAsync();
 
             _logger.LogInformation("Password changed for user {Username}", user.Username);
@@ -139,6 +154,145 @@ public sealed class AccountController : ControllerBase
         }
     }
 
+    [HttpPost("2fa/enable")]
+    public async Task<IActionResult> Enable2fa([FromBody] Enable2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            if (user.TotpEnabled)
+            {
+                return Conflict(new { error = "2FA is already enabled" });
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            // Generate new TOTP
+            var secret = _totpService.GenerateSecret();
+            var qrUri = _totpService.GetQrCodeUri(secret, user.Username);
+            var recoveryCodes = _totpService.GenerateRecoveryCodes();
+
+            user.TotpSecret = secret;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Replace any existing recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            foreach (var code in recoveryCodes)
+            {
+                _usersContext.RecoveryCodes.Add(new RecoveryCode
+                {
+                    Id = Guid.NewGuid(),
+                    UserId = user.Id,
+                    CodeHash = _totpService.HashRecoveryCode(code),
+                    IsUsed = false
+                });
+            }
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA setup generated for user {Username}", user.Username);
+
+            return Ok(new TotpSetupResponse
+            {
+                Secret = secret,
+                QrCodeUri = qrUri,
+                RecoveryCodes = recoveryCodes
+            });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/enable/verify")]
+    public async Task<IActionResult> VerifyEnable2fa([FromBody] VerifyTotpRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser();
+            if (user is null) return Unauthorized();
+
+            if (user.TotpEnabled)
+            {
+                return Conflict(new { error = "2FA is already enabled" });
+            }
+
+            if (string.IsNullOrEmpty(user.TotpSecret))
+            {
+                return BadRequest(new { error = "Generate 2FA setup first" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.Code))
+            {
+                return BadRequest(new { error = "Invalid verification code" });
+            }
+
+            user.TotpEnabled = true;
+            user.UpdatedAt = DateTime.UtcNow;
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA enabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA enabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
+    [HttpPost("2fa/disable")]
+    public async Task<IActionResult> Disable2fa([FromBody] Disable2faRequest request)
+    {
+        await UsersContext.Lock.WaitAsync();
+        try
+        {
+            var user = await GetCurrentUser(includeRecoveryCodes: true);
+            if (user is null) return Unauthorized();
+
+            if (!user.TotpEnabled)
+            {
+                return BadRequest(new { error = "2FA is not enabled" });
+            }
+
+            if (!_passwordService.VerifyPassword(request.Password, user.PasswordHash))
+            {
+                return BadRequest(new { error = "Incorrect password" });
+            }
+
+            if (!_totpService.ValidateCode(user.TotpSecret, request.TotpCode))
+            {
+                return BadRequest(new { error = "Invalid 2FA code" });
+            }
+
+            user.TotpEnabled = false;
+            user.TotpSecret = string.Empty;
+            user.UpdatedAt = DateTime.UtcNow;
+
+            // Remove all recovery codes
+            _usersContext.RecoveryCodes.RemoveRange(user.RecoveryCodes);
+
+            await _usersContext.SaveChangesAsync();
+
+            _logger.LogInformation("2FA disabled for user {Username}", user.Username);
+
+            return Ok(new { message = "2FA disabled" });
+        }
+        finally
+        {
+            UsersContext.Lock.Release();
+        }
+    }
+
     [HttpGet("api-key")]
     public async Task<IActionResult> GetApiKey()
     {

code/backend/Cleanuparr.Api/Features/Auth/Controllers/AuthController.cs

@@ -1,6 +1,8 @@
 using System.Security.Cryptography;
+using Cleanuparr.Api.Auth;
 using Cleanuparr.Api.Features.Auth.Contracts.Requests;
 using Cleanuparr.Api.Features.Auth.Contracts.Responses;
+using Cleanuparr.Api.Filters;
 using Cleanuparr.Infrastructure.Features.Auth;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Auth;
@@ -13,6 +15,7 @@ namespace Cleanuparr.Api.Features.Auth.Controllers;
 [ApiController]
 [Route("api/auth")]
 [AllowAnonymous]
+[NoCache]
 public sealed class AuthController : ControllerBase
 {
     private readonly UsersContext _usersContext;
@@ -43,10 +46,25 @@ public sealed class AuthController : ControllerBase
     {
         var user = await _usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
 
+        var authBypass = false;
+        await using var dataContext = DataContext.CreateStaticInstance();
+        var generalConfig = await dataContext.GeneralConfigs.AsNoTracking().FirstOrDefaultAsync();
+        if (generalConfig is { Auth.DisableAuthForLocalAddresses: true })
+        {
+            var clientIp = TrustedNetworkAuthenticationHandler.ResolveClientIp(
+                HttpContext, generalConfig.Auth.TrustForwardedHeaders);
+            if (clientIp is not null)
+            {
+                authBypass = TrustedNetworkAuthenticationHandler.IsTrustedAddress(
+                    clientIp, generalConfig.Auth.TrustedNetworks);
+            }
+        }
+
         return Ok(new AuthStatusResponse
         {
             SetupCompleted = user is { SetupCompleted: true },
-            PlexLinked = user?.PlexAccountId is not null
+            PlexLinked = user?.PlexAccountId is not null,
+            AuthBypassActive = authBypass
         });
     }
 
@@ -103,9 +121,9 @@ public sealed class AuthController : ControllerBase
                 return BadRequest(new { error = "Create an account first" });
             }
 
-            if (user.SetupCompleted && user.TotpEnabled)
+            if (user.SetupCompleted)
             {
-                return Conflict(new { error = "2FA is already configured" });
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
             }
 
             // Generate new TOTP secret
@@ -160,6 +178,11 @@ public sealed class AuthController : ControllerBase
                 return BadRequest(new { error = "Create an account first" });
             }
 
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage 2FA." });
+            }
+
             if (string.IsNullOrEmpty(user.TotpSecret))
             {
                 return BadRequest(new { error = "Generate 2FA setup first" });
@@ -196,9 +219,9 @@ public sealed class AuthController : ControllerBase
                 return BadRequest(new { error = "Create an account first" });
             }
 
-            if (!user.TotpEnabled)
+            if (user.SetupCompleted)
             {
-                return BadRequest(new { error = "2FA must be configured before completing setup" });
+                return Conflict(new { error = "Setup already completed" });
             }
 
             user.SetupCompleted = true;
@@ -242,6 +265,22 @@ public sealed class AuthController : ControllerBase
         // Reset failed attempts on successful password verification
         await ResetFailedAttempts(user.Id);
 
+        // If 2FA is not enabled, issue tokens directly
+        if (!user.TotpEnabled)
+        {
+            // Re-fetch with tracking since the query above used AsNoTracking
+            var trackedUser = await _usersContext.Users.FirstAsync(u => u.Id == user.Id);
+            var tokenResponse = await GenerateTokenResponse(trackedUser);
+
+            _logger.LogInformation("User {Username} logged in (2FA disabled)", user.Username);
+
+            return Ok(new LoginResponse
+            {
+                RequiresTwoFactor = false,
+                Tokens = tokenResponse
+            });
+        }
+
         // Password valid - require 2FA
         var loginToken = _jwtService.GenerateLoginToken(user.Id);
 
@@ -355,6 +394,11 @@ public sealed class AuthController : ControllerBase
             return BadRequest(new { error = "Create an account first" });
         }
 
+        if (user.SetupCompleted)
+        {
+            return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+        }
+
         var pin = await _plexAuthService.RequestPin();
 
         return Ok(new PlexPinStatusResponse
@@ -385,6 +429,11 @@ public sealed class AuthController : ControllerBase
                 return BadRequest(new { error = "Create an account first" });
             }
 
+            if (user.SetupCompleted)
+            {
+                return Conflict(new { error = "Setup already completed. Use account settings to manage Plex." });
+            }
+
             user.PlexAccountId = plexAccount.AccountId;
             user.PlexUsername = plexAccount.Username;
             user.PlexEmail = plexAccount.Email;
@@ -445,7 +494,10 @@ public sealed class AuthController : ControllerBase
             return Unauthorized(new { error = "Plex account does not match the linked account" });
         }
 
-        // Plex login bypasses 2FA
+        // Plex OAuth acts as a trusted identity provider — the user explicitly linked their
+        // Plex account during setup or via account settings (both require authentication).
+        // Since Plex login verifies the exact same Plex account ID that was linked,
+        // 2FA is not required for Plex login.
         _logger.LogInformation("User {Username} logged in via Plex", user.Username);
 
         var tokenResponse = await GenerateTokenResponse(user);
@@ -477,7 +529,7 @@ public sealed class AuthController : ControllerBase
         {
             AccessToken = accessToken,
             RefreshToken = refreshToken,
-            ExpiresIn = 60 // seconds
+            ExpiresIn = 3600 // seconds
         };
     }
 

code/backend/Cleanuparr.Api/Features/BlacklistSync/Controllers/BlacklistSyncConfigController.cs

@@ -6,6 +6,7 @@ using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.BlacklistSync;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -14,6 +15,7 @@ namespace Cleanuparr.Api.Features.BlacklistSync.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class BlacklistSyncConfigController : ControllerBase
 {
     private readonly ILogger<BlacklistSyncConfigController> _logger;

code/backend/Cleanuparr.Api/Features/DownloadCleaner/Controllers/DownloadCleanerConfigController.cs

@@ -9,6 +9,7 @@ using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration;
 using Cleanuparr.Persistence.Models.Configuration.DownloadCleaner;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -17,6 +18,7 @@ namespace Cleanuparr.Api.Features.DownloadCleaner.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class DownloadCleanerConfigController : ControllerBase
 {
     private readonly ILogger<DownloadCleanerConfigController> _logger;

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/CreateDownloadClientRequest.cs

@@ -3,6 +3,7 @@ using System;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 
@@ -47,6 +48,11 @@ public sealed record CreateDownloadClientRequest
         {
             throw new ValidationException("External URL is not a valid URL");
         }
+
+        if (Password.IsPlaceholder())
+        {
+            throw new ValidationException("Password cannot be a placeholder value");
+        }
     }
 
     public DownloadClientConfig ToEntity() => new()

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/TestDownloadClientRequest.cs

@@ -3,6 +3,7 @@ using System;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 
@@ -20,6 +21,8 @@ public sealed record TestDownloadClientRequest
 
     public string? UrlBase { get; init; }
 
+    public Guid? ClientId { get; init; }
+
     public void Validate()
     {
         if (string.IsNullOrWhiteSpace(Host))
@@ -33,16 +36,26 @@ public sealed record TestDownloadClientRequest
         }
     }
 
-    public DownloadClientConfig ToTestConfig() => new()
+    public DownloadClientConfig ToTestConfig(string? resolvedPassword = null)
     {
-        Id = Guid.NewGuid(),
-        Enabled = true,
-        Name = "Test Client",
-        TypeName = TypeName,
-        Type = Type,
-        Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
-        Username = Username,
-        Password = Password,
-        UrlBase = UrlBase,
-    };
+        var password = resolvedPassword ?? Password;
+
+        if (password.IsPlaceholder())
+        {
+            throw new ValidationException("Password cannot be a placeholder value");
+        }
+
+        return new()
+        {
+            Id = Guid.NewGuid(),
+            Enabled = true,
+            Name = "Test Client",
+            TypeName = TypeName,
+            Type = Type,
+            Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
+            Username = Username,
+            Password = password,
+            UrlBase = UrlBase,
+        };
+    }
 }

code/backend/Cleanuparr.Api/Features/DownloadClient/Contracts/Requests/UpdateDownloadClientRequest.cs

@@ -3,6 +3,7 @@ using System;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Persistence.Models.Configuration;
+using Cleanuparr.Shared.Helpers;
 
 namespace Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 
@@ -57,7 +58,7 @@ public sealed record UpdateDownloadClientRequest
         Type = Type,
         Host = new Uri(Host!, UriKind.RelativeOrAbsolute),
         Username = Username,
-        Password = Password,
+        Password = Password.IsPlaceholder() ? existing.Password : Password,
         UrlBase = UrlBase,
         ExternalUrl = !string.IsNullOrWhiteSpace(ExternalUrl) ? new Uri(ExternalUrl, UriKind.RelativeOrAbsolute) : null,
     };

code/backend/Cleanuparr.Api/Features/DownloadClient/Controllers/DownloadClientController.cs

@@ -5,6 +5,8 @@ using Cleanuparr.Api.Features.DownloadClient.Contracts.Requests;
 using Cleanuparr.Infrastructure.Features.DownloadClient;
 using Cleanuparr.Infrastructure.Http.DynamicHttpClientSystem;
 using Cleanuparr.Persistence;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -12,6 +14,7 @@ namespace Cleanuparr.Api.Features.DownloadClient.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class DownloadClientController : ControllerBase
 {
     private readonly ILogger<DownloadClientController> _logger;
@@ -156,7 +159,23 @@ public sealed class DownloadClientController : ControllerBase
         {
             request.Validate();
 
-            var testConfig = request.ToTestConfig();
+            string? resolvedPassword = null;
+
+            if (request.Password.IsPlaceholder() && request.ClientId.HasValue)
+            {
+                var existingClient = await _dataContext.DownloadClients
+                    .AsNoTracking()
+                    .FirstOrDefaultAsync(c => c.Id == request.ClientId.Value);
+
+                if (existingClient is null)
+                {
+                    return NotFound($"Download client with ID {request.ClientId.Value} not found");
+                }
+
+                resolvedPassword = existingClient.Password;
+            }
+
+            var testConfig = request.ToTestConfig(resolvedPassword);
             using var downloadService = _downloadServiceFactory.GetDownloadService(testConfig);
             var healthResult = await downloadService.HealthCheckAsync();
 

code/backend/Cleanuparr.Api/Features/General/Contracts/Requests/UpdateGeneralConfigRequest.cs

@@ -34,6 +34,8 @@ public sealed record UpdateGeneralConfigRequest
 
     public UpdateLoggingConfigRequest Log { get; init; } = new();
 
+    public UpdateAuthConfigRequest Auth { get; init; } = new();
+
     public GeneralConfig ApplyTo(GeneralConfig existingConfig, IServiceProvider services, ILogger logger)
     {
         existingConfig.DisplaySupportBanner = DisplaySupportBanner;
@@ -49,6 +51,7 @@ public sealed record UpdateGeneralConfigRequest
         existingConfig.StrikeInactivityWindowHours = StrikeInactivityWindowHours;
 
         bool loggingChanged = Log.ApplyTo(existingConfig.Log);
+        Auth.ApplyTo(existingConfig.Auth);
 
         Validate(existingConfig);
 
@@ -75,6 +78,7 @@ public sealed record UpdateGeneralConfigRequest
         }
 
         config.Log.Validate();
+        config.Auth.Validate();
     }
 
     private void ApplySideEffects(GeneralConfig config, IServiceProvider services, ILogger logger, bool loggingChanged)
@@ -145,3 +149,19 @@ public sealed record UpdateLoggingConfigRequest
 
     public bool LevelOnlyChange { get; private set; }
 }
+
+public sealed record UpdateAuthConfigRequest
+{
+    public bool DisableAuthForLocalAddresses { get; init; }
+
+    public bool TrustForwardedHeaders { get; init; }
+
+    public List<string> TrustedNetworks { get; init; } = [];
+
+    public void ApplyTo(AuthConfig existingConfig)
+    {
+        existingConfig.DisableAuthForLocalAddresses = DisableAuthForLocalAddresses;
+        existingConfig.TrustForwardedHeaders = TrustForwardedHeaders;
+        existingConfig.TrustedNetworks = TrustedNetworks;
+    }
+}

code/backend/Cleanuparr.Api/Features/General/Controllers/GeneralConfigController.cs

@@ -4,6 +4,7 @@ using System.Threading.Tasks;
 
 using Cleanuparr.Api.Features.General.Contracts.Requests;
 using Cleanuparr.Persistence;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -12,6 +13,7 @@ namespace Cleanuparr.Api.Features.General.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class GeneralConfigController : ControllerBase
 {
     private readonly ILogger<GeneralConfigController> _logger;

code/backend/Cleanuparr.Api/Features/MalwareBlocker/Contracts/Requests/UpdateMalwareBlockerConfigRequest.cs

@@ -16,7 +16,7 @@ public sealed record UpdateMalwareBlockerConfigRequest
 
     public bool DeletePrivate { get; init; }
 
-    public bool DeleteKnownMalware { get; init; }
+    public bool ProcessNoContentId { get; init; }
 
     public BlocklistSettings Sonarr { get; init; } = new();
 
@@ -37,7 +37,7 @@ public sealed record UpdateMalwareBlockerConfigRequest
         config.UseAdvancedScheduling = UseAdvancedScheduling;
         config.IgnorePrivate = IgnorePrivate;
         config.DeletePrivate = DeletePrivate;
-        config.DeleteKnownMalware = DeleteKnownMalware;
+        config.ProcessNoContentId = ProcessNoContentId;
         config.Sonarr = Sonarr;
         config.Radarr = Radarr;
         config.Lidarr = Lidarr;

code/backend/Cleanuparr.Api/Features/MalwareBlocker/Controllers/MalwareBlockerConfigController.cs

@@ -8,6 +8,7 @@ using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration;
 using Cleanuparr.Persistence.Models.Configuration.MalwareBlocker;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -16,6 +17,7 @@ namespace Cleanuparr.Api.Features.MalwareBlocker.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class MalwareBlockerConfigController : ControllerBase
 {
     private readonly ILogger<MalwareBlockerConfigController> _logger;

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestAppriseProviderRequest.cs

@@ -15,4 +15,6 @@ public record TestAppriseProviderRequest
 
     // CLI mode fields
     public string? ServiceUrls { get; init; }
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestDiscordProviderRequest.cs

@@ -7,4 +7,6 @@ public record TestDiscordProviderRequest
     public string Username { get; init; } = string.Empty;
 
     public string AvatarUrl { get; init; } = string.Empty;
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestGotifyProviderRequest.cs

@@ -7,4 +7,6 @@ public record TestGotifyProviderRequest
     public string ApplicationToken { get; init; } = string.Empty;
 
     public int Priority { get; init; } = 5;
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestNotifiarrProviderRequest.cs

@@ -3,6 +3,8 @@ namespace Cleanuparr.Api.Features.Notifications.Contracts.Requests;
 public record TestNotifiarrProviderRequest
 {
     public string ApiKey { get; init; } = string.Empty;
-    
+
     public string ChannelId { get; init; } = string.Empty;
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestNtfyProviderRequest.cs

@@ -19,4 +19,6 @@ public record TestNtfyProviderRequest
     public NtfyPriority Priority { get; init; } = NtfyPriority.Default;
     
     public List<string> Tags { get; init; } = [];
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestPushoverProviderRequest.cs

@@ -19,4 +19,6 @@ public record TestPushoverProviderRequest
     public int? Expire { get; init; }
 
     public List<string> Tags { get; init; } = [];
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Contracts/Requests/TestTelegramProviderRequest.cs

@@ -9,4 +9,6 @@ public sealed record TestTelegramProviderRequest
     public string? TopicId { get; init; }
 
     public bool SendSilently { get; init; }
+
+    public Guid? ProviderId { get; init; }
 }

code/backend/Cleanuparr.Api/Features/Notifications/Controllers/NotificationProvidersController.cs

@@ -11,6 +11,8 @@ using Cleanuparr.Infrastructure.Features.Notifications.Telegram;
 using Cleanuparr.Infrastructure.Features.Notifications.Gotify;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.Notification;
+using Cleanuparr.Shared.Helpers;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 
@@ -18,6 +20,7 @@ namespace Cleanuparr.Api.Features.Notifications.Controllers;
 
 [ApiController]
 [Route("api/configuration/notification_providers")]
+[Authorize]
 public sealed class NotificationProvidersController : ControllerBase
 {
     private readonly ILogger<NotificationProvidersController> _logger;
@@ -127,6 +130,11 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.ApiKey.IsPlaceholder())
+            {
+                return BadRequest("API key cannot be a placeholder value");
+            }
+
             var notifiarrConfig = new NotifiarrConfig
             {
                 ApiKey = newProvider.ApiKey,
@@ -184,6 +192,16 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.Key.IsPlaceholder())
+            {
+                return BadRequest("Key cannot be a placeholder value");
+            }
+
+            if (newProvider.ServiceUrls.IsPlaceholder())
+            {
+                return BadRequest("Service URLs cannot be a placeholder value");
+            }
+
             var appriseConfig = new AppriseConfig
             {
                 Mode = newProvider.Mode,
@@ -248,6 +266,16 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.Password.IsPlaceholder())
+            {
+                return BadRequest("Password cannot be a placeholder value");
+            }
+
+            if (newProvider.AccessToken.IsPlaceholder())
+            {
+                return BadRequest("Access token cannot be a placeholder value");
+            }
+
             var ntfyConfig = new NtfyConfig
             {
                 ServerUrl = newProvider.ServerUrl,
@@ -315,6 +343,11 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.BotToken.IsPlaceholder())
+            {
+                return BadRequest("Bot token cannot be a placeholder value");
+            }
+
             var telegramConfig = new TelegramConfig
             {
                 BotToken = newProvider.BotToken,
@@ -392,7 +425,9 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var notifiarrConfig = new NotifiarrConfig
             {
-                ApiKey = updatedProvider.ApiKey,
+                ApiKey = updatedProvider.ApiKey.IsPlaceholder()
+                    ? existingProvider.NotifiarrConfiguration!.ApiKey
+                    : updatedProvider.ApiKey,
                 ChannelId = updatedProvider.ChannelId
             };
 
@@ -473,9 +508,13 @@ public sealed class NotificationProvidersController : ControllerBase
             {
                 Mode = updatedProvider.Mode,
                 Url = updatedProvider.Url,
-                Key = updatedProvider.Key,
+                Key = updatedProvider.Key.IsPlaceholder()
+                    ? existingProvider.AppriseConfiguration!.Key
+                    : updatedProvider.Key,
                 Tags = updatedProvider.Tags,
-                ServiceUrls = updatedProvider.ServiceUrls
+                ServiceUrls = updatedProvider.ServiceUrls.IsPlaceholder()
+                    ? existingProvider.AppriseConfiguration!.ServiceUrls
+                    : updatedProvider.ServiceUrls
             };
 
             if (existingProvider.AppriseConfiguration != null)
@@ -557,8 +596,12 @@ public sealed class NotificationProvidersController : ControllerBase
                 Topics = updatedProvider.Topics,
                 AuthenticationType = updatedProvider.AuthenticationType,
                 Username = updatedProvider.Username,
-                Password = updatedProvider.Password,
-                AccessToken = updatedProvider.AccessToken,
+                Password = updatedProvider.Password.IsPlaceholder()
+                    ? existingProvider.NtfyConfiguration!.Password
+                    : updatedProvider.Password,
+                AccessToken = updatedProvider.AccessToken.IsPlaceholder()
+                    ? existingProvider.NtfyConfiguration!.AccessToken
+                    : updatedProvider.AccessToken,
                 Priority = updatedProvider.Priority,
                 Tags = updatedProvider.Tags
             };
@@ -638,7 +681,9 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var telegramConfig = new TelegramConfig
             {
-                BotToken = updatedProvider.BotToken,
+                BotToken = updatedProvider.BotToken.IsPlaceholder()
+                    ? existingProvider.TelegramConfiguration!.BotToken
+                    : updatedProvider.BotToken,
                 ChatId = updatedProvider.ChatId,
                 TopicId = updatedProvider.TopicId,
                 SendSilently = updatedProvider.SendSilently
@@ -735,9 +780,24 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var apiKey = testRequest.ApiKey;
+
+            if (apiKey.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<NotifiarrConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Notifiarr, p => p.NotifiarrConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "API key cannot be a placeholder value" });
+                }
+
+                apiKey = existing.ApiKey;
+            }
+
             var notifiarrConfig = new NotifiarrConfig
             {
-                ApiKey = testRequest.ApiKey,
+                ApiKey = apiKey,
                 ChannelId = testRequest.ChannelId
             };
             notifiarrConfig.Validate();
@@ -775,13 +835,37 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var key = testRequest.Key;
+            var serviceUrls = testRequest.ServiceUrls;
+
+            if (key.IsPlaceholder() || serviceUrls.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<AppriseConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Apprise, p => p.AppriseConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Sensitive fields cannot be placeholder values" });
+                }
+
+                if (key.IsPlaceholder())
+                {
+                    key = existing.Key;
+                }
+
+                if (serviceUrls.IsPlaceholder())
+                {
+                    serviceUrls = existing.ServiceUrls;
+                }
+            }
+
             var appriseConfig = new AppriseConfig
             {
                 Mode = testRequest.Mode,
                 Url = testRequest.Url,
-                Key = testRequest.Key,
+                Key = key,
                 Tags = testRequest.Tags,
-                ServiceUrls = testRequest.ServiceUrls
+                ServiceUrls = serviceUrls
             };
             appriseConfig.Validate();
 
@@ -822,14 +906,38 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var password = testRequest.Password;
+            var accessToken = testRequest.AccessToken;
+
+            if (password.IsPlaceholder() || accessToken.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<NtfyConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Ntfy, p => p.NtfyConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Sensitive fields cannot be placeholder values" });
+                }
+
+                if (password.IsPlaceholder())
+                {
+                    password = existing.Password;
+                }
+
+                if (accessToken.IsPlaceholder())
+                {
+                    accessToken = existing.AccessToken;
+                }
+            }
+
             var ntfyConfig = new NtfyConfig
             {
                 ServerUrl = testRequest.ServerUrl,
                 Topics = testRequest.Topics,
                 AuthenticationType = testRequest.AuthenticationType,
                 Username = testRequest.Username,
-                Password = testRequest.Password,
-                AccessToken = testRequest.AccessToken,
+                Password = password,
+                AccessToken = accessToken,
                 Priority = testRequest.Priority,
                 Tags = testRequest.Tags
             };
@@ -868,9 +976,24 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var botToken = testRequest.BotToken;
+
+            if (botToken.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<TelegramConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Telegram, p => p.TelegramConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Bot token cannot be a placeholder value" });
+                }
+
+                botToken = existing.BotToken;
+            }
+
             var telegramConfig = new TelegramConfig
             {
-                BotToken = testRequest.BotToken,
+                BotToken = botToken,
                 ChatId = testRequest.ChatId,
                 TopicId = testRequest.TopicId,
                 SendSilently = testRequest.SendSilently
@@ -958,6 +1081,11 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.WebhookUrl.IsPlaceholder())
+            {
+                return BadRequest("Webhook URL cannot be a placeholder value");
+            }
+
             var discordConfig = new DiscordConfig
             {
                 WebhookUrl = newProvider.WebhookUrl,
@@ -1034,7 +1162,9 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var discordConfig = new DiscordConfig
             {
-                WebhookUrl = updatedProvider.WebhookUrl,
+                WebhookUrl = updatedProvider.WebhookUrl.IsPlaceholder()
+                    ? existingProvider.DiscordConfiguration!.WebhookUrl
+                    : updatedProvider.WebhookUrl,
                 Username = updatedProvider.Username,
                 AvatarUrl = updatedProvider.AvatarUrl
             };
@@ -1088,9 +1218,24 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var webhookUrl = testRequest.WebhookUrl;
+
+            if (webhookUrl.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<DiscordConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Discord, p => p.DiscordConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Webhook URL cannot be a placeholder value" });
+                }
+
+                webhookUrl = existing.WebhookUrl;
+            }
+
             var discordConfig = new DiscordConfig
             {
-                WebhookUrl = testRequest.WebhookUrl,
+                WebhookUrl = webhookUrl,
                 Username = testRequest.Username,
                 AvatarUrl = testRequest.AvatarUrl
             };
@@ -1146,6 +1291,16 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.ApiToken.IsPlaceholder())
+            {
+                return BadRequest("API token cannot be a placeholder value");
+            }
+
+            if (newProvider.UserKey.IsPlaceholder())
+            {
+                return BadRequest("User key cannot be a placeholder value");
+            }
+
             var pushoverConfig = new PushoverConfig
             {
                 ApiToken = newProvider.ApiToken,
@@ -1227,8 +1382,12 @@ public sealed class NotificationProvidersController : ControllerBase
 
             var pushoverConfig = new PushoverConfig
             {
-                ApiToken = updatedProvider.ApiToken,
-                UserKey = updatedProvider.UserKey,
+                ApiToken = updatedProvider.ApiToken.IsPlaceholder()
+                    ? existingProvider.PushoverConfiguration!.ApiToken
+                    : updatedProvider.ApiToken,
+                UserKey = updatedProvider.UserKey.IsPlaceholder()
+                    ? existingProvider.PushoverConfiguration!.UserKey
+                    : updatedProvider.UserKey,
                 Devices = updatedProvider.Devices,
                 Priority = updatedProvider.Priority,
                 Sound = updatedProvider.Sound,
@@ -1286,10 +1445,34 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var apiToken = testRequest.ApiToken;
+            var userKey = testRequest.UserKey;
+
+            if (apiToken.IsPlaceholder() || userKey.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<PushoverConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Pushover, p => p.PushoverConfiguration);
+
+                if (existing is null)
+                {
+                    return BadRequest(new { Message = "Sensitive fields cannot be placeholder values" });
+                }
+
+                if (apiToken.IsPlaceholder())
+                {
+                    apiToken = existing.ApiToken;
+                }
+
+                if (userKey.IsPlaceholder())
+                {
+                    userKey = existing.UserKey;
+                }
+            }
+
             var pushoverConfig = new PushoverConfig
             {
-                ApiToken = testRequest.ApiToken,
-                UserKey = testRequest.UserKey,
+                ApiToken = apiToken,
+                UserKey = userKey,
                 Devices = testRequest.Devices,
                 Priority = testRequest.Priority,
                 Sound = testRequest.Sound,
@@ -1344,6 +1527,11 @@ public sealed class NotificationProvidersController : ControllerBase
                 return BadRequest("A provider with this name already exists");
             }
 
+            if (newProvider.ApplicationToken.IsPlaceholder())
+            {
+                return BadRequest("Application token cannot be a placeholder value");
+            }
+
             var gotifyConfig = new GotifyConfig
             {
                 ServerUrl = newProvider.ServerUrl,
@@ -1421,7 +1609,9 @@ public sealed class NotificationProvidersController : ControllerBase
             var gotifyConfig = new GotifyConfig
             {
                 ServerUrl = updatedProvider.ServerUrl,
-                ApplicationToken = updatedProvider.ApplicationToken,
+                ApplicationToken = updatedProvider.ApplicationToken.IsPlaceholder()
+                    ? existingProvider.GotifyConfiguration!.ApplicationToken
+                    : updatedProvider.ApplicationToken,
                 Priority = updatedProvider.Priority
             };
 
@@ -1474,10 +1664,23 @@ public sealed class NotificationProvidersController : ControllerBase
     {
         try
         {
+            var applicationToken = testRequest.ApplicationToken;
+
+            if (applicationToken.IsPlaceholder())
+            {
+                var existing = await GetExistingProviderConfig<GotifyConfig>(
+                    testRequest.ProviderId, NotificationProviderType.Gotify, p => p.GotifyConfiguration);
+
+                if (existing is null)
+                    return BadRequest(new { Message = "Application token cannot be a placeholder value" });
+
+                applicationToken = existing.ApplicationToken;
+            }
+
             var gotifyConfig = new GotifyConfig
             {
                 ServerUrl = testRequest.ServerUrl,
-                ApplicationToken = testRequest.ApplicationToken,
+                ApplicationToken = applicationToken,
                 Priority = testRequest.Priority
             };
             gotifyConfig.Validate();
@@ -1514,4 +1717,34 @@ public sealed class NotificationProvidersController : ControllerBase
             return BadRequest(new { Message = $"Test failed: {ex.Message}" });
         }
     }
+
+    private async Task<T?> GetExistingProviderConfig<T>(
+        Guid? providerId,
+        NotificationProviderType expectedType,
+        Func<NotificationConfig, T?> configSelector) where T : class
+    {
+        if (!providerId.HasValue)
+        {
+            return null;
+        }
+
+        IQueryable<NotificationConfig> query = _dataContext.NotificationConfigs.AsNoTracking();
+
+        query = expectedType switch
+        {
+            NotificationProviderType.Notifiarr => query.Include(p => p.NotifiarrConfiguration),
+            NotificationProviderType.Apprise => query.Include(p => p.AppriseConfiguration),
+            NotificationProviderType.Ntfy => query.Include(p => p.NtfyConfiguration),
+            NotificationProviderType.Pushover => query.Include(p => p.PushoverConfiguration),
+            NotificationProviderType.Telegram => query.Include(p => p.TelegramConfiguration),
+            NotificationProviderType.Discord => query.Include(p => p.DiscordConfiguration),
+            NotificationProviderType.Gotify => query.Include(p => p.GotifyConfiguration),
+            _ => query
+        };
+
+        var provider = await query
+            .FirstOrDefaultAsync(p => p.Id == providerId.Value && p.Type == expectedType);
+
+        return provider is null ? null : configSelector(provider);
+    }
 }

code/backend/Cleanuparr.Api/Features/QueueCleaner/Contracts/Requests/UpdateQueueCleanerConfigRequest.cs

@@ -13,6 +13,8 @@ public sealed record UpdateQueueCleanerConfigRequest
     public FailedImportConfig FailedImport { get; init; } = new();
 
     public ushort DownloadingMetadataMaxStrikes { get; init; }
-    
+
+    public bool ProcessNoContentId { get; init; }
+
     public List<string> IgnoredDownloads { get; set; } = [];
 }

code/backend/Cleanuparr.Api/Features/QueueCleaner/Controllers/QueueCleanerConfigController.cs

@@ -7,6 +7,7 @@ using Cleanuparr.Infrastructure.Utilities;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration;
 using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -15,6 +16,7 @@ namespace Cleanuparr.Api.Features.QueueCleaner.Controllers;
 
 [ApiController]
 [Route("api/configuration")]
+[Authorize]
 public sealed class QueueCleanerConfigController : ControllerBase
 {
     private readonly ILogger<QueueCleanerConfigController> _logger;
@@ -67,6 +69,7 @@ public sealed class QueueCleanerConfigController : ControllerBase
             oldConfig.UseAdvancedScheduling = newConfigDto.UseAdvancedScheduling;
             oldConfig.FailedImport = newConfigDto.FailedImport;
             oldConfig.DownloadingMetadataMaxStrikes = newConfigDto.DownloadingMetadataMaxStrikes;
+            oldConfig.ProcessNoContentId = newConfigDto.ProcessNoContentId;
             oldConfig.IgnoredDownloads = newConfigDto.IgnoredDownloads;
             
             oldConfig.Validate();

code/backend/Cleanuparr.Api/Features/QueueCleaner/Controllers/QueueRulesController.cs

@@ -3,6 +3,7 @@ using Cleanuparr.Domain.Exceptions;
 using Cleanuparr.Infrastructure.Services.Interfaces;
 using Cleanuparr.Persistence;
 using Cleanuparr.Persistence.Models.Configuration.QueueCleaner;
+using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Mvc;
 using Microsoft.EntityFrameworkCore;
 using Microsoft.Extensions.Logging;
@@ -11,6 +12,7 @@ namespace Cleanuparr.Api.Features.QueueCleaner.Controllers;
 
 [ApiController]
 [Route("api/queue-rules")]
+[Authorize]
 public class QueueRulesController : ControllerBase
 {
     private readonly ILogger<QueueRulesController> _logger;

code/backend/Cleanuparr.Api/Filters/NoCacheAttribute.cs

@@ -0,0 +1,25 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace Cleanuparr.Api.Filters;
+
+/// <summary>
+/// Prevents caching of sensitive responses by setting appropriate HTTP headers.
+/// Applies Cache-Control: no-cache, no-store, Pragma: no-cache, and a past Expires date
+/// for maximum compatibility with HTTP/1.0 and HTTP/1.1 clients and intermediaries.
+/// </summary>
+[AttributeUsage(AttributeTargets.Class | AttributeTargets.Method)]
+public sealed class NoCacheAttribute : ActionFilterAttribute
+{
+    public static void Apply(IHeaderDictionary headers)
+    {
+        headers.CacheControl = "no-cache, no-store";
+        headers.Pragma = "no-cache";
+        headers.Expires = "Thu, 01 Jan 1970 00:00:00 GMT";
+    }
+
+    public override void OnResultExecuting(ResultExecutingContext context)
+    {
+        Apply(context.HttpContext.Response.Headers);
+        base.OnResultExecuting(context);
+    }
+}

code/backend/Cleanuparr.Api/Json/SensitiveDataResolver.cs

@@ -0,0 +1,70 @@
+using System.Reflection;
+using System.Text.Json;
+using System.Text.Json.Serialization.Metadata;
+
+using Cleanuparr.Shared.Attributes;
+using Cleanuparr.Shared.Helpers;
+
+namespace Cleanuparr.Api.Json;
+
+/// <summary>
+/// JSON type info resolver that masks properties decorated with <see cref="SensitiveDataAttribute"/>
+/// by replacing their serialized values with the appropriate placeholder during serialization.
+/// </summary>
+public sealed class SensitiveDataResolver : IJsonTypeInfoResolver
+{
+    private readonly IJsonTypeInfoResolver _innerResolver;
+
+    public SensitiveDataResolver(IJsonTypeInfoResolver innerResolver)
+    {
+        _innerResolver = innerResolver;
+    }
+
+    public JsonTypeInfo? GetTypeInfo(Type type, JsonSerializerOptions options)
+    {
+        var typeInfo = _innerResolver.GetTypeInfo(type, options);
+
+        if (typeInfo?.Kind != JsonTypeInfoKind.Object)
+            return typeInfo;
+
+        foreach (var property in typeInfo.Properties)
+        {
+            if (property.AttributeProvider is not PropertyInfo propertyInfo)
+                continue;
+
+            var sensitiveAttr = propertyInfo.GetCustomAttribute<SensitiveDataAttribute>();
+            if (sensitiveAttr is null)
+                continue;
+
+            ApplyMasking(property, sensitiveAttr.Type);
+        }
+
+        return typeInfo;
+    }
+
+    private static void ApplyMasking(JsonPropertyInfo property, SensitiveDataType maskType)
+    {
+        var originalGet = property.Get;
+        if (originalGet is null)
+        {
+            return;
+        }
+
+        property.Get = maskType switch
+        {
+            SensitiveDataType.Full => obj =>
+            {
+                var value = originalGet(obj);
+                return value is string ? SensitiveDataHelper.Placeholder : value;
+            },
+
+            SensitiveDataType.AppriseUrl => obj =>
+            {
+                var value = originalGet(obj);
+                return value is string s ? SensitiveDataHelper.MaskAppriseUrls(s) : value;
+            },
+
+            _ => originalGet,
+        };
+    }
+}

code/backend/Cleanuparr.Api/Middleware/SetupGuardMiddleware.cs

@@ -15,52 +15,75 @@ public class SetupGuardMiddleware
 
     public async Task InvokeAsync(HttpContext context)
     {
-        // Fast path: setup already completed
+        string path = context.Request.Path.Value?.ToLowerInvariant() ?? "";
+
+        // Always allow health checks and non-API paths (static files, SPA, etc.)
+        if (path.StartsWith("/health") || !path.StartsWith("/api/"))
+        {
+            await _next(context);
+            return;
+        }
+
+        // Setup-only paths (/api/auth/setup/*) require setup to NOT be complete
+        if (IsSetupOnlyPath(path))
+        {
+            if (await IsSetupCompleted())
+            {
+                context.Response.StatusCode = StatusCodes.Status403Forbidden;
+                context.Response.ContentType = "application/json";
+                await context.Response.WriteAsJsonAsync(new { error = "Setup already completed" });
+                return;
+            }
+
+            await _next(context);
+            return;
+        }
+
+        // Non-setup auth paths (login, refresh, logout, status) are always allowed
+        if (path.StartsWith("/api/auth/") || path == "/api/auth")
+        {
+            await _next(context);
+            return;
+        }
+
+        // All other API paths require setup to be complete
+        if (!await IsSetupCompleted())
+        {
+            context.Response.StatusCode = StatusCodes.Status403Forbidden;
+            context.Response.ContentType = "application/json";
+            await context.Response.WriteAsJsonAsync(new { error = "Setup required" });
+            return;
+        }
+
+        await _next(context);
+    }
+
+    public void ResetSetupState()
+    {
+        _setupCompleted = false;
+    }
+
+    private async Task<bool> IsSetupCompleted()
+    {
         if (_setupCompleted)
         {
-            await _next(context);
-            return;
+            return true;
         }
 
-        var path = context.Request.Path.Value?.ToLowerInvariant() ?? "";
-
-        // Always allow these paths regardless of setup state
-        if (IsAllowedPath(path))
-        {
-            await _next(context);
-            return;
-        }
-
-        // Check database for setup completion
         await using var usersContext = UsersContext.CreateStaticInstance();
         var user = await usersContext.Users.AsNoTracking().FirstOrDefaultAsync();
 
         if (user is { SetupCompleted: true })
         {
             _setupCompleted = true;
-            await _next(context);
-            return;
+            return true;
         }
 
-        // Setup not complete - block non-auth requests
-        context.Response.StatusCode = StatusCodes.Status403Forbidden;
-        context.Response.ContentType = "application/json";
-        await context.Response.WriteAsJsonAsync(new { error = "Setup required" });
+        return false;
     }
 
-    /// <summary>
-    /// Resets the cached setup state. Call this if the user database is reset.
-    /// </summary>
-    public void ResetSetupState()
+    private static bool IsSetupOnlyPath(string path)
     {
-        _setupCompleted = false;
-    }
-
-    private static bool IsAllowedPath(string path)
-    {
-        return path.StartsWith("/api/auth/")
-               || path == "/api/auth"
-               || path.StartsWith("/health")
-               || !path.StartsWith("/api/");
+        return path.StartsWith("/api/auth/setup/") || path == "/api/auth/setup";
     }
 }

code/backend/Cleanuparr.Api/Program.cs

@@ -131,6 +131,13 @@ if (basePath is not null)
         {
             if (!string.IsNullOrEmpty(basePath) && !context.Request.Path.StartsWithSegments(basePath, StringComparison.OrdinalIgnoreCase))
             {
+                // Redirect root to the base path for convenience
+                if (!context.Request.Path.HasValue || context.Request.Path.Value == "/")
+                {
+                    context.Response.Redirect(basePath + "/");
+                    return;
+                }
+
                 context.Response.StatusCode = StatusCodes.Status404NotFound;
                 return;
             }
@@ -174,4 +181,4 @@ await app.RunAsync();
 await Log.CloseAndFlushAsync();
 
 // Make Program class accessible for testing
-public partial class Program { }
+public partial class Program { }

code/backend/Cleanuparr.Domain/Enums/DeleteReason.cs

@@ -11,5 +11,4 @@ public enum DeleteReason
     AllFilesSkipped,
     AllFilesSkippedByQBit,
     AllFilesBlocked,
-    MalwareFileFound,
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/Arr/WhisparrV2ClientTests.cs

@@ -1,10 +1,8 @@
-using Cleanuparr.Domain.Entities.Arr.Queue;
 using Cleanuparr.Infrastructure.Features.Arr;
 using Cleanuparr.Infrastructure.Features.ItemStriker;
 using Cleanuparr.Infrastructure.Interceptors;
 using Microsoft.Extensions.Logging;
 using Moq;
-using Xunit;
 
 namespace Cleanuparr.Infrastructure.Tests.Features.Arr;
 
@@ -35,144 +33,4 @@ public class WhisparrV2ClientTests
             _dryRunInterceptorMock.Object
         );
     }
-
-    #region IsRecordValid Tests
-
-    [Fact]
-    public void IsRecordValid_WhenEpisodeIdIsZero_ReturnsFalse()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Episode",
-            DownloadId = "abc123",
-            Protocol = "torrent",
-            EpisodeId = 0,
-            SeriesId = 1
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.False(result);
-        _loggerMock.Verify(
-            x => x.Log(
-                LogLevel.Debug,
-                It.IsAny<EventId>(),
-                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("episode id and/or series id missing")),
-                It.IsAny<Exception?>(),
-                It.IsAny<Func<It.IsAnyType, Exception?, string>>()
-            ),
-            Times.Once
-        );
-    }
-
-    [Fact]
-    public void IsRecordValid_WhenSeriesIdIsZero_ReturnsFalse()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Episode",
-            DownloadId = "abc123",
-            Protocol = "torrent",
-            EpisodeId = 1,
-            SeriesId = 0
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.False(result);
-    }
-
-    [Fact]
-    public void IsRecordValid_WhenBothIdsAreZero_ReturnsFalse()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Episode",
-            DownloadId = "abc123",
-            Protocol = "torrent",
-            EpisodeId = 0,
-            SeriesId = 0
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.False(result);
-    }
-
-    [Fact]
-    public void IsRecordValid_WhenBothIdsAreSet_ReturnsTrue()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Episode",
-            DownloadId = "abc123",
-            Protocol = "torrent",
-            EpisodeId = 42,
-            SeriesId = 10
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.True(result);
-    }
-
-    [Fact]
-    public void IsRecordValid_WhenDownloadIdIsNull_ReturnsFalse()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Episode",
-            DownloadId = null!,
-            Protocol = "torrent",
-            EpisodeId = 42,
-            SeriesId = 10
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.False(result);
-    }
-
-    [Fact]
-    public void IsRecordValid_WhenDownloadIdIsEmpty_ReturnsFalse()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Episode",
-            DownloadId = "",
-            Protocol = "torrent",
-            EpisodeId = 42,
-            SeriesId = 10
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.False(result);
-    }
-
-    #endregion
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/Arr/WhisparrV3ClientTests.cs

@@ -1,10 +1,8 @@
-using Cleanuparr.Domain.Entities.Arr.Queue;
 using Cleanuparr.Infrastructure.Features.Arr;
 using Cleanuparr.Infrastructure.Features.ItemStriker;
 using Cleanuparr.Infrastructure.Interceptors;
 using Microsoft.Extensions.Logging;
 using Moq;
-using Xunit;
 
 namespace Cleanuparr.Infrastructure.Tests.Features.Arr;
 
@@ -35,98 +33,4 @@ public class WhisparrV3ClientTests
             _dryRunInterceptorMock.Object
         );
     }
-
-    #region IsRecordValid Tests
-
-    [Fact]
-    public void IsRecordValid_WhenMovieIdIsZero_ReturnsFalse()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Movie",
-            DownloadId = "abc123",
-            Protocol = "torrent",
-            MovieId = 0
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.False(result);
-        _loggerMock.Verify(
-            x => x.Log(
-                LogLevel.Debug,
-                It.IsAny<EventId>(),
-                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("movie id missing")),
-                It.IsAny<Exception?>(),
-                It.IsAny<Func<It.IsAnyType, Exception?, string>>()
-            ),
-            Times.Once
-        );
-    }
-
-    [Fact]
-    public void IsRecordValid_WhenMovieIdIsSet_ReturnsTrue()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Movie",
-            DownloadId = "abc123",
-            Protocol = "torrent",
-            MovieId = 42
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.True(result);
-    }
-
-    [Fact]
-    public void IsRecordValid_WhenDownloadIdIsNull_ReturnsFalse()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Movie",
-            DownloadId = null!,
-            Protocol = "torrent",
-            MovieId = 42
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.False(result);
-    }
-
-    [Fact]
-    public void IsRecordValid_WhenDownloadIdIsEmpty_ReturnsFalse()
-    {
-        // Arrange
-        var record = new QueueRecord
-        {
-            Id = 1,
-            Title = "Test Movie",
-            DownloadId = "",
-            Protocol = "torrent",
-            MovieId = 42
-        };
-
-        // Act
-        var result = _client.IsRecordValid(record);
-
-        // Assert
-        Assert.False(result);
-    }
-
-    #endregion
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/DownloadRemover/QueueItemRemoverTests.cs

@@ -275,6 +275,55 @@ public class QueueItemRemoverTests : IDisposable
 
     #endregion
 
+    #region RemoveQueueItemAsync - SkipSearch Tests
+
+    [Fact]
+    public async Task RemoveQueueItemAsync_WhenSkipSearch_DoesNotPublishHuntRequest()
+    {
+        // Arrange
+        var request = CreateRemoveRequest(skipSearch: true);
+
+        _arrClientMock
+            .Setup(c => c.DeleteQueueItemAsync(
+                It.IsAny<ArrInstance>(),
+                It.IsAny<QueueRecord>(),
+                It.IsAny<bool>(),
+                It.IsAny<DeleteReason>()))
+            .Returns(Task.CompletedTask);
+
+        // Act
+        await _queueItemRemover.RemoveQueueItemAsync(request);
+
+        // Assert
+        _busMock.Verify(b => b.Publish(
+            It.IsAny<DownloadHuntRequest<SearchItem>>(),
+            It.IsAny<CancellationToken>()), Times.Never);
+    }
+
+    [Fact]
+    public async Task RemoveQueueItemAsync_WhenSkipSearch_AndHashIsNotRecurring_DoesNotModifyRecurringHashes()
+    {
+        // Arrange
+        var request = CreateRemoveRequest(skipSearch: true);
+        var hash = request.Record.DownloadId.ToLowerInvariant();
+
+        _arrClientMock
+            .Setup(c => c.DeleteQueueItemAsync(
+                It.IsAny<ArrInstance>(),
+                It.IsAny<QueueRecord>(),
+                It.IsAny<bool>(),
+                It.IsAny<DeleteReason>()))
+            .Returns(Task.CompletedTask);
+
+        // Act
+        await _queueItemRemover.RemoveQueueItemAsync(request);
+
+        // Assert - hash was never in recurring, should still not be there
+        Assert.False(Striker.RecurringHashes.ContainsKey(hash));
+    }
+
+    #endregion
+
     #region RemoveQueueItemAsync - HTTP Error Tests
 
     [Fact]
@@ -377,7 +426,6 @@ public class QueueItemRemoverTests : IDisposable
     [InlineData(DeleteReason.SlowSpeed)]
     [InlineData(DeleteReason.SlowTime)]
     [InlineData(DeleteReason.DownloadingMetadata)]
-    [InlineData(DeleteReason.MalwareFileFound)]
     public async Task RemoveQueueItemAsync_PassesCorrectDeleteReason(DeleteReason deleteReason)
     {
         // Arrange
@@ -436,7 +484,8 @@ public class QueueItemRemoverTests : IDisposable
     private static QueueItemRemoveRequest<SearchItem> CreateRemoveRequest(
         InstanceType instanceType = InstanceType.Sonarr,
         bool removeFromClient = true,
-        DeleteReason deleteReason = DeleteReason.Stalled)
+        DeleteReason deleteReason = DeleteReason.Stalled,
+        bool skipSearch = false)
     {
         return new QueueItemRemoveRequest<SearchItem>
         {
@@ -446,6 +495,7 @@ public class QueueItemRemoverTests : IDisposable
             Record = CreateQueueRecord(),
             RemoveFromClient = removeFromClient,
             DeleteReason = deleteReason,
+            SkipSearch = skipSearch,
             JobRunId = Guid.NewGuid()
         };
     }

code/backend/Cleanuparr.Infrastructure.Tests/Features/Jobs/MalwareBlockerTests.cs

@@ -159,24 +159,21 @@ public class MalwareBlockerTests : IDisposable
         _fixture.ArrClientFactory.Verify(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()), Times.Once);
     }
 
-    [Fact]
-    public async Task ExecuteInternalAsync_WhenDeleteKnownMalwareEnabled_ProcessesAllArrs()
+    [Theory]
+    [InlineData(InstanceType.Radarr)]
+    [InlineData(InstanceType.Lidarr)]
+    [InlineData(InstanceType.Readarr)]
+    [InlineData(InstanceType.Whisparr)]
+    public async Task ExecuteInternalAsync_WhenArrTypeEnabled_ProcessesCorrectInstances(InstanceType instanceType)
     {
         // Arrange
         TestDataContextFactory.AddDownloadClient(_fixture.DataContext);
-
-        var contentBlockerConfig = _fixture.DataContext.ContentBlockerConfigs.First();
-        contentBlockerConfig.DeleteKnownMalware = true;
-        // Need at least one blocklist enabled for processing to occur
-        contentBlockerConfig.Sonarr = new BlocklistSettings { Enabled = true };
-        _fixture.DataContext.SaveChanges();
-
-        TestDataContextFactory.AddSonarrInstance(_fixture.DataContext);
-        TestDataContextFactory.AddRadarrInstance(_fixture.DataContext);
+        EnableBlocklist(instanceType);
+        AddArrInstance(instanceType);
 
         var mockArrClient = new Mock<IArrClient>();
         _fixture.ArrClientFactory
-            .Setup(x => x.GetClient(It.IsAny<InstanceType>(), It.IsAny<float>()))
+            .Setup(x => x.GetClient(instanceType, It.IsAny<float>()))
             .Returns(mockArrClient.Object);
 
         _fixture.ArrQueueIterator
@@ -192,9 +189,8 @@ public class MalwareBlockerTests : IDisposable
         // Act
         await sut.ExecuteAsync();
 
-        // Assert - Sonarr and Radarr processed because DeleteKnownMalware is true
-        _fixture.ArrClientFactory.Verify(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()), Times.Once);
-        _fixture.ArrClientFactory.Verify(x => x.GetClient(InstanceType.Radarr, It.IsAny<float>()), Times.Once);
+        // Assert
+        _fixture.ArrClientFactory.Verify(x => x.GetClient(instanceType, It.IsAny<float>()), Times.Once);
     }
 
     #endregion
@@ -215,6 +211,7 @@ public class MalwareBlockerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
@@ -225,7 +222,9 @@ public class MalwareBlockerTests : IDisposable
             Id = 1,
             DownloadId = "ignored-download-id",
             Title = "Ignored Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -267,6 +266,7 @@ public class MalwareBlockerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
@@ -277,7 +277,9 @@ public class MalwareBlockerTests : IDisposable
             Id = 1,
             DownloadId = "torrent-download-id",
             Title = "Torrent Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -325,6 +327,7 @@ public class MalwareBlockerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
@@ -401,6 +404,7 @@ public class MalwareBlockerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
@@ -472,6 +476,7 @@ public class MalwareBlockerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
@@ -482,7 +487,9 @@ public class MalwareBlockerTests : IDisposable
             Id = 1,
             DownloadId = "missing-download-id",
             Title = "Missing Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -526,6 +533,142 @@ public class MalwareBlockerTests : IDisposable
         );
     }
 
+    [Fact]
+    public async Task ProcessInstanceAsync_SkipsItem_WhenMissingContentId_AndProcessNoContentIdIsFalse()
+    {
+        // Arrange
+        TestDataContextFactory.AddDownloadClient(_fixture.DataContext);
+        EnableSonarrBlocklist();
+        TestDataContextFactory.AddSonarrInstance(_fixture.DataContext);
+
+        var mockArrClient = new Mock<IArrClient>();
+        mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(false);
+
+        _fixture.ArrClientFactory
+            .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
+            .Returns(mockArrClient.Object);
+
+        var queueRecord = new QueueRecord
+        {
+            Id = 1,
+            DownloadId = "no-content-id-download",
+            Title = "No Content ID Download",
+            Protocol = "torrent"
+        };
+
+        _fixture.ArrQueueIterator
+            .Setup(x => x.Iterate(
+                It.IsAny<IArrClient>(),
+                It.IsAny<ArrInstance>(),
+                It.IsAny<Func<IReadOnlyList<QueueRecord>, Task>>()
+            ))
+            .Returns(async (IArrClient client, ArrInstance instance, Func<IReadOnlyList<QueueRecord>, Task> callback) =>
+            {
+                await callback([queueRecord]);
+            });
+
+        var sut = CreateSut();
+
+        // Act
+        await sut.ExecuteAsync();
+
+        // Assert
+        _logger.Verify(
+            x => x.Log(
+                LogLevel.Information,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("skip | item is missing the content id")),
+                It.IsAny<Exception?>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()
+            ),
+            Times.Once
+        );
+
+        _fixture.MessageBus.Verify(
+            x => x.Publish(
+                It.IsAny<QueueItemRemoveRequest<SeriesSearchItem>>(),
+                It.IsAny<CancellationToken>()
+            ),
+            Times.Never
+        );
+    }
+
+    [Fact]
+    public async Task ProcessInstanceAsync_WhenMissingContentId_AndProcessNoContentIdIsTrue_PublishesRemoveRequestWithSkipSearch()
+    {
+        // Arrange
+        TestDataContextFactory.AddDownloadClient(_fixture.DataContext);
+        EnableSonarrBlocklist();
+        TestDataContextFactory.AddSonarrInstance(_fixture.DataContext);
+
+        var contentBlockerConfig = _fixture.DataContext.ContentBlockerConfigs.First();
+        contentBlockerConfig.ProcessNoContentId = true;
+        _fixture.DataContext.SaveChanges();
+
+        var mockArrClient = new Mock<IArrClient>();
+        mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(false);
+
+        _fixture.ArrClientFactory
+            .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
+            .Returns(mockArrClient.Object);
+
+        var queueRecord = new QueueRecord
+        {
+            Id = 1,
+            DownloadId = "no-content-id-download",
+            Title = "No Content ID Download",
+            Protocol = "torrent"
+        };
+
+        _fixture.ArrQueueIterator
+            .Setup(x => x.Iterate(
+                It.IsAny<IArrClient>(),
+                It.IsAny<ArrInstance>(),
+                It.IsAny<Func<IReadOnlyList<QueueRecord>, Task>>()
+            ))
+            .Returns(async (IArrClient client, ArrInstance instance, Func<IReadOnlyList<QueueRecord>, Task> callback) =>
+            {
+                await callback([queueRecord]);
+            });
+
+        var mockDownloadService = _fixture.CreateMockDownloadService();
+        mockDownloadService
+            .Setup(x => x.BlockUnwantedFilesAsync(
+                It.IsAny<string>(),
+                It.IsAny<List<string>>()
+            ))
+            .ReturnsAsync(new BlockFilesResult
+            {
+                Found = true,
+                ShouldRemove = true,
+                IsPrivate = false,
+                DeleteReason = DeleteReason.AllFilesBlocked
+            });
+
+        _fixture.DownloadServiceFactory
+            .Setup(x => x.GetDownloadService(It.IsAny<DownloadClientConfig>()))
+            .Returns(mockDownloadService.Object);
+
+        var sut = CreateSut();
+
+        // Act
+        await sut.ExecuteAsync();
+
+        // Assert - SkipSearch must be true because the item has no content ID
+        _fixture.MessageBus.Verify(
+            x => x.Publish(
+                It.Is<QueueItemRemoveRequest<SeriesSearchItem>>(r =>
+                    r.SkipSearch == true &&
+                    r.DeleteReason == DeleteReason.AllFilesBlocked
+                ),
+                It.IsAny<CancellationToken>()
+            ),
+            Times.Once
+        );
+    }
+
     #endregion
 
     #region Error Handling Tests
@@ -540,6 +683,7 @@ public class MalwareBlockerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
@@ -550,7 +694,9 @@ public class MalwareBlockerTests : IDisposable
             Id = 1,
             DownloadId = "error-download-id",
             Title = "Error Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -605,5 +751,32 @@ public class MalwareBlockerTests : IDisposable
         _fixture.DataContext.SaveChanges();
     }
 
+    private void EnableBlocklist(InstanceType instanceType)
+    {
+        var config = _fixture.DataContext.ContentBlockerConfigs.First();
+        var settings = new BlocklistSettings { Enabled = true };
+        switch (instanceType)
+        {
+            case InstanceType.Radarr:   config.Radarr   = settings; break;
+            case InstanceType.Lidarr:   config.Lidarr   = settings; break;
+            case InstanceType.Readarr:  config.Readarr  = settings; break;
+            case InstanceType.Whisparr: config.Whisparr = settings; break;
+            default: throw new ArgumentOutOfRangeException(nameof(instanceType));
+        }
+        _fixture.DataContext.SaveChanges();
+    }
+
+    private void AddArrInstance(InstanceType instanceType)
+    {
+        switch (instanceType)
+        {
+            case InstanceType.Radarr:   TestDataContextFactory.AddRadarrInstance(_fixture.DataContext);   break;
+            case InstanceType.Lidarr:   TestDataContextFactory.AddLidarrInstance(_fixture.DataContext);   break;
+            case InstanceType.Readarr:  TestDataContextFactory.AddReadarrInstance(_fixture.DataContext);  break;
+            case InstanceType.Whisparr: TestDataContextFactory.AddWhisparrInstance(_fixture.DataContext); break;
+            default: throw new ArgumentOutOfRangeException(nameof(instanceType));
+        }
+    }
+
     #endregion
 }

code/backend/Cleanuparr.Infrastructure.Tests/Features/Jobs/QueueCleanerTests.cs

@@ -220,6 +220,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
@@ -230,7 +231,9 @@ public class QueueCleanerTests : IDisposable
             Id = 1,
             DownloadId = "ignored-download-id",
             Title = "Ignored Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -275,6 +278,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
@@ -285,7 +289,9 @@ public class QueueCleanerTests : IDisposable
             Id = 1,
             DownloadId = "cached-download-id",
             Title = "Cached Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -326,6 +332,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
         mockArrClient.Setup(x => x.ShouldRemoveFromQueue(
             It.IsAny<InstanceType>(),
             It.IsAny<QueueRecord>(),
@@ -342,7 +349,9 @@ public class QueueCleanerTests : IDisposable
             Id = 1,
             DownloadId = "torrent-download-id",
             Title = "Torrent Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -389,6 +398,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
@@ -458,6 +468,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
         mockArrClient.Setup(x => x.ShouldRemoveFromQueue(
             It.IsAny<InstanceType>(),
             It.IsAny<QueueRecord>(),
@@ -474,7 +485,9 @@ public class QueueCleanerTests : IDisposable
             Id = 1,
             DownloadId = "missing-download-id",
             Title = "Missing Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -527,6 +540,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
         mockArrClient.Setup(x => x.ShouldRemoveFromQueue(
             It.IsAny<InstanceType>(),
             It.IsAny<QueueRecord>(),
@@ -543,7 +557,9 @@ public class QueueCleanerTests : IDisposable
             Id = 1,
             DownloadId = "download-id",
             Title = "Test Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -595,6 +611,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
         mockArrClient.Setup(x => x.ShouldRemoveFromQueue(
             It.IsAny<InstanceType>(),
             It.IsAny<QueueRecord>(),
@@ -656,6 +673,147 @@ public class QueueCleanerTests : IDisposable
         );
     }
 
+    [Fact]
+    public async Task ProcessInstanceAsync_SkipsItem_WhenMissingContentId_AndProcessNoContentIdIsFalse()
+    {
+        // Arrange
+        TestDataContextFactory.AddSonarrInstance(_fixture.DataContext);
+        TestDataContextFactory.AddDownloadClient(_fixture.DataContext);
+
+        var mockArrClient = new Mock<IArrClient>();
+        mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(false);
+
+        _fixture.ArrClientFactory
+            .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
+            .Returns(mockArrClient.Object);
+
+        var queueRecord = new QueueRecord
+        {
+            Id = 1,
+            DownloadId = "no-content-id-download",
+            Title = "No Content ID Download",
+            Protocol = "torrent"
+        };
+
+        _fixture.ArrQueueIterator
+            .Setup(x => x.Iterate(
+                It.IsAny<IArrClient>(),
+                It.IsAny<ArrInstance>(),
+                It.IsAny<Func<IReadOnlyList<QueueRecord>, Task>>()
+            ))
+            .Returns(async (IArrClient client, ArrInstance instance, Func<IReadOnlyList<QueueRecord>, Task> callback) =>
+            {
+                await callback([queueRecord]);
+            });
+
+        var sut = CreateSut();
+
+        // Act
+        await sut.ExecuteAsync();
+
+        // Assert
+        _logger.Verify(
+            x => x.Log(
+                LogLevel.Information,
+                It.IsAny<EventId>(),
+                It.Is<It.IsAnyType>((v, t) => v.ToString()!.Contains("skip | item is missing the content id")),
+                It.IsAny<Exception?>(),
+                It.IsAny<Func<It.IsAnyType, Exception?, string>>()
+            ),
+            Times.Once
+        );
+
+        _fixture.MessageBus.Verify(
+            x => x.Publish(
+                It.IsAny<QueueItemRemoveRequest<SeriesSearchItem>>(),
+                It.IsAny<CancellationToken>()
+            ),
+            Times.Never
+        );
+    }
+
+    [Fact]
+    public async Task ProcessInstanceAsync_WhenMissingContentId_AndProcessNoContentIdIsTrue_PublishesRemoveRequestWithSkipSearch()
+    {
+        // Arrange
+        TestDataContextFactory.AddSonarrInstance(_fixture.DataContext);
+        TestDataContextFactory.AddDownloadClient(_fixture.DataContext);
+
+        var queueCleanerConfig = _fixture.DataContext.QueueCleanerConfigs.First();
+        queueCleanerConfig.ProcessNoContentId = true;
+        _fixture.DataContext.SaveChanges();
+
+        var mockArrClient = new Mock<IArrClient>();
+        mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(false);
+        mockArrClient.Setup(x => x.ShouldRemoveFromQueue(
+            It.IsAny<InstanceType>(),
+            It.IsAny<QueueRecord>(),
+            It.IsAny<bool>(),
+            It.IsAny<short>()
+        )).ReturnsAsync(false);
+
+        _fixture.ArrClientFactory
+            .Setup(x => x.GetClient(InstanceType.Sonarr, It.IsAny<float>()))
+            .Returns(mockArrClient.Object);
+
+        var queueRecord = new QueueRecord
+        {
+            Id = 1,
+            DownloadId = "no-content-id-download",
+            Title = "No Content ID Download",
+            Protocol = "torrent"
+        };
+
+        _fixture.ArrQueueIterator
+            .Setup(x => x.Iterate(
+                It.IsAny<IArrClient>(),
+                It.IsAny<ArrInstance>(),
+                It.IsAny<Func<IReadOnlyList<QueueRecord>, Task>>()
+            ))
+            .Returns(async (IArrClient client, ArrInstance instance, Func<IReadOnlyList<QueueRecord>, Task> callback) =>
+            {
+                await callback([queueRecord]);
+            });
+
+        var mockDownloadService = _fixture.CreateMockDownloadService();
+        mockDownloadService
+            .Setup(x => x.ShouldRemoveFromArrQueueAsync(
+                It.IsAny<string>(),
+                It.IsAny<List<string>>()
+            ))
+            .ReturnsAsync(new DownloadCheckResult
+            {
+                Found = true,
+                ShouldRemove = true,
+                IsPrivate = false,
+                DeleteFromClient = true,
+                DeleteReason = DeleteReason.Stalled
+            });
+
+        _fixture.DownloadServiceFactory
+            .Setup(x => x.GetDownloadService(It.IsAny<DownloadClientConfig>()))
+            .Returns(mockDownloadService.Object);
+
+        var sut = CreateSut();
+
+        // Act
+        await sut.ExecuteAsync();
+
+        // Assert - SkipSearch must be true because the item has no content ID
+        _fixture.MessageBus.Verify(
+            x => x.Publish(
+                It.Is<QueueItemRemoveRequest<SeriesSearchItem>>(r =>
+                    r.SkipSearch == true &&
+                    r.DeleteReason == DeleteReason.Stalled
+                ),
+                It.IsAny<CancellationToken>()
+            ),
+            Times.Once
+        );
+    }
+
     #endregion
 
     #region Error Handling Tests
@@ -669,6 +827,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
         mockArrClient.Setup(x => x.ShouldRemoveFromQueue(
             It.IsAny<InstanceType>(),
             It.IsAny<QueueRecord>(),
@@ -685,7 +844,9 @@ public class QueueCleanerTests : IDisposable
             Id = 1,
             DownloadId = "error-download-id",
             Title = "Error Download",
-            Protocol = "torrent"
+            Protocol = "torrent",
+            SeriesId = 1,
+            EpisodeId = 1
         };
 
         _fixture.ArrQueueIterator
@@ -744,6 +905,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Radarr, It.IsAny<float>()))
@@ -833,6 +995,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Radarr, It.IsAny<float>()))
@@ -905,6 +1068,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Lidarr, It.IsAny<float>()))
@@ -977,6 +1141,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Readarr, It.IsAny<float>()))
@@ -1049,6 +1214,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Whisparr, 2f))
@@ -1124,6 +1290,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Whisparr, 3f))
@@ -1196,6 +1363,7 @@ public class QueueCleanerTests : IDisposable
 
         var mockArrClient = new Mock<IArrClient>();
         mockArrClient.Setup(x => x.IsRecordValid(It.IsAny<QueueRecord>())).Returns(true);
+        mockArrClient.Setup(x => x.HasContentId(It.IsAny<QueueRecord>())).Returns(true);
 
         _fixture.ArrClientFactory
             .Setup(x => x.GetClient(InstanceType.Whisparr, 2f))

code/backend/Cleanuparr.Infrastructure.Tests/Features/Jobs/TestHelpers/TestDataContextFactory.cs

@@ -75,7 +75,6 @@ public static class TestDataContextFactory
         {
             Id = Guid.NewGuid(),
             IgnoredDownloads = [],
-            DeleteKnownMalware = false,
             DeletePrivate = false,
             Sonarr = new BlocklistSettings { Enabled = false },
             Radarr = new BlocklistSettings { Enabled = false },

code/backend/Cleanuparr.Infrastructure.Tests/Features/MalwareBlocker/BlocklistProviderTests.cs

@@ -118,34 +118,6 @@ public class BlocklistProviderTests : IDisposable
         result.Count.ShouldBe(2);
     }
 
-    [Fact]
-    public void GetMalwarePatterns_NotInCache_ReturnsEmptyBag()
-    {
-        // Act
-        var result = _provider.GetMalwarePatterns();
-
-        // Assert
-        result.ShouldNotBeNull();
-        result.ShouldBeEmpty();
-    }
-
-    [Fact]
-    public void GetMalwarePatterns_InCache_ReturnsCachedPatterns()
-    {
-        // Arrange
-        var patterns = new ConcurrentBag<string> { "known_malware.exe", "trojan*", "virus.dll" };
-        _cache.Set(CacheKeys.KnownMalwarePatterns(), patterns);
-
-        // Act
-        var result = _provider.GetMalwarePatterns();
-
-        // Assert
-        result.Count.ShouldBe(3);
-        result.ShouldContain("known_malware.exe");
-        result.ShouldContain("trojan*");
-        result.ShouldContain("virus.dll");
-    }
-
     [Theory]
     [InlineData(InstanceType.Sonarr)]
     [InlineData(InstanceType.Radarr)]

code/backend/Cleanuparr.Infrastructure.Tests/Features/Notifications/NotificationPublisherTests.cs

@@ -271,12 +271,12 @@ public class NotificationPublisherTests
             .Returns(providerMock.Object);
 
         // Act
-        await _publisher.NotifyQueueItemDeleted(false, DeleteReason.MalwareFileFound);
+        await _publisher.NotifyQueueItemDeleted(false, DeleteReason.AllFilesBlocked);
 
         // Assert
         providerMock.Verify(p => p.SendNotificationAsync(It.Is<NotificationContext>(
             c => c.Data["Removed from client?"] == "False" &&
-                 c.Data["Reason"] == "MalwareFileFound")), Times.Once);
+                 c.Data["Reason"] == "AllFilesBlocked")), Times.Once);
     }
 
     #endregion

code/backend/Cleanuparr.Infrastructure/Events/EventPublisher.cs

@@ -232,7 +232,7 @@ public class EventPublisher : IEventPublisher
     public async Task PublishSearchNotTriggered(string hash, string itemName)
     {
         await PublishManualAsync(
-            "Replacement search was not triggered after removal because the item keeps coming back\nPlease trigger a manual search if needed",
+            "Replacement search was not triggered after removal\nPlease trigger a manual search if needed",
             EventSeverity.Warning,
             data: new { itemName, hash }
         );

code/backend/Cleanuparr.Infrastructure/Features/Arr/ArrClient.cs

@@ -158,7 +158,7 @@ public abstract class ArrClient : IArrClient
 
     public abstract Task SearchItemsAsync(ArrInstance arrInstance, HashSet<SearchItem>? items);
 
-    public virtual bool IsRecordValid(QueueRecord record)
+    public bool IsRecordValid(QueueRecord record)
     {
         if (string.IsNullOrEmpty(record.DownloadId))
         {
@@ -169,6 +169,8 @@ public abstract class ArrClient : IArrClient
         return true;
     }
 
+    public abstract bool HasContentId(QueueRecord record);
+
     /// <inheritdoc/>
     public async Task HealthCheckAsync(ArrInstance arrInstance)
     {

code/backend/Cleanuparr.Infrastructure/Features/Arr/Dtos/ArrInstanceDto.cs

@@ -1,4 +1,5 @@
 using System.ComponentModel.DataAnnotations;
+using Cleanuparr.Shared.Attributes;
 
 namespace Cleanuparr.Infrastructure.Features.Arr.Dtos;
 
@@ -23,6 +24,7 @@ public record ArrInstanceDto
     public required string Url { get; init; }
     
     [Required]
+    [SensitiveData]
     public required string ApiKey { get; init; }
 
     public string? ExternalUrl { get; init; }

code/backend/Cleanuparr.Infrastructure/Features/Arr/Interfaces/IArrClient.cs

@@ -17,6 +17,13 @@ public interface IArrClient
     
     bool IsRecordValid(QueueRecord record);
 
+    /// <summary>
+    /// Checks whether the record has an id (movie id, tv show id etc.)
+    /// </summary>
+    /// <param name="record">The record to check</param>
+    /// <returns>True if the record has an id, false otherwise</returns>
+    bool HasContentId(QueueRecord record);
+
     /// <summary>
     /// Tests the connection to an Arr instance
     /// </summary>

code/backend/Cleanuparr.Infrastructure/Features/Arr/LidarrClient.cs

@@ -87,16 +87,7 @@ public class LidarrClient : ArrClient, ILidarrClient
         }
     }
 
-    public override bool IsRecordValid(QueueRecord record)
-    {
-        if (record.ArtistId is 0 || record.AlbumId is 0)
-        {
-            _logger.LogDebug("skip | artist id and/or album id missing | {title}", record.Title);
-            return false;
-        }
-
-        return base.IsRecordValid(record);
-    }
+    public override bool HasContentId(QueueRecord record) => record.ArtistId is not 0 && record.AlbumId is not 0;
 
     private static string GetSearchLog(
         Uri instanceUrl,

code/backend/Cleanuparr.Infrastructure/Features/Arr/RadarrClient.cs

@@ -92,16 +92,7 @@ public class RadarrClient : ArrClient, IRadarrClient
         }
     }
 
-    public override bool IsRecordValid(QueueRecord record)
-    {
-        if (record.MovieId is 0)
-        {
-            _logger.LogDebug("skip | movie id missing | {title}", record.Title);
-            return false;
-        }
-        
-        return base.IsRecordValid(record);
-    }
+    public override bool HasContentId(QueueRecord record) => record.MovieId is not 0;
 
     private static string GetSearchLog(Uri instanceUrl, RadarrCommand command, bool success, string? logContext)
     {

code/backend/Cleanuparr.Infrastructure/Features/Arr/ReadarrClient.cs

@@ -92,16 +92,7 @@ public class ReadarrClient : ArrClient, IReadarrClient
         }
     }
 
-    public override bool IsRecordValid(QueueRecord record)
-    {
-        if (record.AuthorId is 0 || record.BookId is 0)
-        {
-            _logger.LogDebug("skip | author id and/or book id missing | {title}", record.Title);
-            return false;
-        }
-        
-        return base.IsRecordValid(record);
-    }
+    public override bool HasContentId(QueueRecord record) => record.AuthorId is not 0 && record.BookId is not 0;
 
     private static string GetSearchLog(Uri instanceUrl, ReadarrCommand command, bool success, string? logContext)
     {

code/backend/Cleanuparr.Infrastructure/Features/Arr/SonarrClient.cs

@@ -90,16 +90,7 @@ public class SonarrClient : ArrClient, ISonarrClient
         }
     }
 
-    public override bool IsRecordValid(QueueRecord record)
-    {
-        if (record.EpisodeId is 0 || record.SeriesId is 0)
-        {
-            _logger.LogDebug("skip | episode id and/or series id missing | {title}", record.Title);
-            return false;
-        }
-
-        return base.IsRecordValid(record);
-    }
+    public override bool HasContentId(QueueRecord record) => record.EpisodeId is not 0 && record.SeriesId is not 0;
 
     private static string GetSearchLog(
         SeriesSearchType searchType,

code/backend/Cleanuparr.Infrastructure/Features/Arr/WhisparrV2Client.cs

@@ -90,16 +90,7 @@ public class WhisparrV2Client : ArrClient, IWhisparrV2Client
         }
     }
 
-    public override bool IsRecordValid(QueueRecord record)
-    {
-        if (record.EpisodeId is 0 || record.SeriesId is 0)
-        {
-            _logger.LogDebug("skip | episode id and/or series id missing | {title}", record.Title);
-            return false;
-        }
-
-        return base.IsRecordValid(record);
-    }
+    public override bool HasContentId(QueueRecord record) => record.EpisodeId is not 0 && record.SeriesId is not 0;
 
     private static string GetSearchLog(
         SeriesSearchType searchType,

code/backend/Cleanuparr.Infrastructure/Features/Arr/WhisparrV3Client.cs

@@ -93,16 +93,7 @@ public class WhisparrV3Client : ArrClient, IWhisparrV3Client
         }
     }
 
-    public override bool IsRecordValid(QueueRecord record)
-    {
-        if (record.MovieId is 0)
-        {
-            _logger.LogDebug("skip | movie id missing | {title}", record.Title);
-            return false;
-        }
-        
-        return base.IsRecordValid(record);
-    }
+    public override bool HasContentId(QueueRecord record) => record.MovieId is not 0;
 
     private static string GetSearchLog(Uri instanceUrl, WhisparrV3Command command, bool success, string? logContext)
     {

code/backend/Cleanuparr.Infrastructure/Features/Auth/JwtService.cs

@@ -11,7 +11,7 @@ public sealed class JwtService : IJwtService
 {
     private const string Issuer = "Cleanuparr";
     private const string Audience = "Cleanuparr";
-    private static readonly TimeSpan AccessTokenLifetime = TimeSpan.FromMinutes(1);
+    private static readonly TimeSpan AccessTokenLifetime = TimeSpan.FromHours(1);
     private static readonly TimeSpan LoginTokenLifetime = TimeSpan.FromMinutes(5);
 
     private readonly byte[] _signingKey;

code/backend/Cleanuparr.Infrastructure/Features/DownloadClient/Deluge/DelugeServiceCB.cs

@@ -68,7 +68,6 @@ public partial class DelugeService
         BlocklistType blocklistType = _blocklistProvider.GetBlocklistType(instanceType);
         ConcurrentBag<string> patterns = _blocklistProvider.GetPatterns(instanceType);
         ConcurrentBag<Regex> regexes = _blocklistProvider.GetRegexes(instanceType);
-        ConcurrentBag<string> malwarePatterns = _blocklistProvider.GetMalwarePatterns();
 
         ProcessFiles(contents.Contents, (name, file) =>
         {
@@ -79,13 +78,6 @@ public partial class DelugeService
             {
                 return;
             }
-            
-            if (malwareBlockerConfig.DeleteKnownMalware && _filenameEvaluator.IsKnownMalware(name, malwarePatterns))
-            {
-                _logger.LogInformation("malware file found | {file} | {title}", file.Path, download.Name);
-                result.ShouldRemove = true;
-                result.DeleteReason = DeleteReason.MalwareFileFound;
-            }
 
             if (file.Priority is 0)
             {

code/backend/Cleanuparr.Infrastructure/Features/DownloadClient/QBittorrent/QBitServiceCB.cs

@@ -73,8 +73,7 @@ public partial class QBitService
         BlocklistType blocklistType = _blocklistProvider.GetBlocklistType(instanceType);
         ConcurrentBag<string> patterns = _blocklistProvider.GetPatterns(instanceType);
         ConcurrentBag<Regex> regexes = _blocklistProvider.GetRegexes(instanceType);
-        ConcurrentBag<string> malwarePatterns = _blocklistProvider.GetMalwarePatterns();
-        
+
         foreach (TorrentContent file in files)
         {
             if (!file.Index.HasValue)
@@ -84,14 +83,6 @@ public partial class QBitService
             }
 
             totalFiles++;
-            
-            if (malwareBlockerConfig.DeleteKnownMalware && _filenameEvaluator.IsKnownMalware(file.Name, malwarePatterns))
-            {
-                _logger.LogInformation("malware file found | {file} | {title}", file.Name, download.Name);
-                result.ShouldRemove = true;
-                result.DeleteReason = DeleteReason.MalwareFileFound;
-                return result;
-            }
 
             if (file.Priority is TorrentContentPriority.Skip)
             {

code/backend/Cleanuparr.Infrastructure/Features/DownloadClient/RTorrent/RTorrentServiceCB.cs

@@ -71,7 +71,6 @@ public partial class RTorrentService
         BlocklistType blocklistType = _blocklistProvider.GetBlocklistType(instanceType);
         ConcurrentBag<string> patterns = _blocklistProvider.GetPatterns(instanceType);
         ConcurrentBag<Regex> regexes = _blocklistProvider.GetRegexes(instanceType);
-        ConcurrentBag<string> malwarePatterns = _blocklistProvider.GetMalwarePatterns();
 
         List<(int Index, int Priority)> priorityUpdates = [];
 
@@ -85,13 +84,6 @@ public partial class RTorrentService
                 continue;
             }
 
-            if (malwareBlockerConfig.DeleteKnownMalware && _filenameEvaluator.IsKnownMalware(fileName, malwarePatterns))
-            {
-                _logger.LogInformation("malware file found | {file} | {title}", file.Path, download.Name);
-                result.ShouldRemove = true;
-                result.DeleteReason = DeleteReason.MalwareFileFound;
-            }
-
             if (file.Priority == 0)
             {
                 _logger.LogTrace("File is already skipped | {file}", file.Path);

code/backend/Cleanuparr.Infrastructure/Features/DownloadClient/Transmission/TransmissionServiceCB.cs

@@ -56,8 +56,7 @@ public partial class TransmissionService
         BlocklistType blocklistType = _blocklistProvider.GetBlocklistType(instanceType);
         ConcurrentBag<string> patterns = _blocklistProvider.GetPatterns(instanceType);
         ConcurrentBag<Regex> regexes = _blocklistProvider.GetRegexes(instanceType);
-        ConcurrentBag<string> malwarePatterns = _blocklistProvider.GetMalwarePatterns();
-        
+
         for (int i = 0; i < download.Files.Length; i++)
         {
             if (download.FileStats?[i].Wanted == null)
@@ -67,15 +66,7 @@ public partial class TransmissionService
             }
 
             totalFiles++;
-            
-            if (malwareBlockerConfig.DeleteKnownMalware && _filenameEvaluator.IsKnownMalware(download.Files[i].Name, malwarePatterns))
-            {
-                _logger.LogInformation("malware file found | {file} | {title}", download.Files[i].Name, download.Name);
-                result.ShouldRemove = true;
-                result.DeleteReason = DeleteReason.MalwareFileFound;
-                return result;
-            }
-            
+
             if (!download.FileStats[i].Wanted.Value)
             {
                 _logger.LogTrace("File is already skipped | {file}", download.Files[i].Name);

code/backend/Cleanuparr.Infrastructure/Features/DownloadClient/UTorrent/UTorrentServiceCB.cs

@@ -61,18 +61,9 @@ public partial class UTorrentService
         BlocklistType blocklistType = _blocklistProvider.GetBlocklistType(instanceType);
         ConcurrentBag<string> patterns = _blocklistProvider.GetPatterns(instanceType);
         ConcurrentBag<Regex> regexes = _blocklistProvider.GetRegexes(instanceType);
-        ConcurrentBag<string> malwarePatterns = _blocklistProvider.GetMalwarePatterns();
 
         for (int i = 0; i < files.Count; i++)
         {
-            if (malwareBlockerConfig.DeleteKnownMalware && _filenameEvaluator.IsKnownMalware(files[i].Name, malwarePatterns))
-            {
-                _logger.LogInformation("malware file found | {file} | {title}", files[i].Name, download.Name);
-                result.ShouldRemove = true;
-                result.DeleteReason = DeleteReason.MalwareFileFound;
-                return result;
-            }
-            
             var file = files[i];
 
             if (file.Priority == 0) // Already skipped

code/backend/Cleanuparr.Infrastructure/Features/DownloadRemover/Models/QueueItemRemoveRequest.cs

@@ -21,4 +21,6 @@ public sealed record QueueItemRemoveRequest<T>
     public required DeleteReason DeleteReason { get; init; }
 
     public required Guid JobRunId { get; init; }
+
+    public bool SkipSearch { get; init; }
 }

code/backend/Cleanuparr.Infrastructure/Features/DownloadRemover/QueueItemRemover.cs

@@ -73,15 +73,20 @@ public sealed class QueueItemRemover : IQueueItemRemover
             ContextProvider.Set(nameof(InstanceType), request.InstanceType);
             ContextProvider.Set(ContextProvider.Keys.Version, request.Instance.Version);
 
-            // Use the new centralized EventPublisher method
             await _eventPublisher.PublishQueueItemDeleted(request.RemoveFromClient, request.DeleteReason);
 
-            // If recurring, do not search for replacement
             string hash = request.Record.DownloadId.ToLowerInvariant();
-            if (Striker.RecurringHashes.ContainsKey(hash))
+            var isRecurring = Striker.RecurringHashes.ContainsKey(hash);
+            
+            if (isRecurring || request.SkipSearch)
             {
                 await _eventPublisher.PublishSearchNotTriggered(request.Record.DownloadId, request.Record.Title);
-                Striker.RecurringHashes.Remove(hash, out _);
+                
+                if (isRecurring)
+                {
+                    Striker.RecurringHashes.Remove(hash, out _);
+                }
+
                 return;
             }
 

code/backend/Cleanuparr.Infrastructure/Features/Jobs/GenericHandler.cs

@@ -131,7 +131,8 @@ public abstract class GenericHandler : IHandler
         QueueRecord record,
         bool isPack,
         bool removeFromClient,
-        DeleteReason deleteReason
+        DeleteReason deleteReason,
+        bool skipSearch = false
     )
     {
         if (_cache.TryGetValue(downloadRemovalKey, out bool _))
@@ -139,7 +140,7 @@ public abstract class GenericHandler : IHandler
             _logger.LogDebug("skip removal request | already marked for removal | {title}", record.Title);
             return;
         }
-        
+
         if (instanceType is InstanceType.Sonarr || (instanceType is InstanceType.Whisparr && instance.Version is 2))
         {
             QueueItemRemoveRequest<SeriesSearchItem> removeRequest = new()
@@ -150,7 +151,8 @@ public abstract class GenericHandler : IHandler
                 SearchItem = (SeriesSearchItem)GetRecordSearchItem(instanceType, instance.Version, record, isPack),
                 RemoveFromClient = removeFromClient,
                 DeleteReason = deleteReason,
-                JobRunId = ContextProvider.GetJobRunId()
+                JobRunId = ContextProvider.GetJobRunId(),
+                SkipSearch = skipSearch
             };
 
             await _messageBus.Publish(removeRequest);
@@ -165,7 +167,8 @@ public abstract class GenericHandler : IHandler
                 SearchItem = GetRecordSearchItem(instanceType, instance.Version, record, isPack),
                 RemoveFromClient = removeFromClient,
                 DeleteReason = deleteReason,
-                JobRunId = ContextProvider.GetJobRunId()
+                JobRunId = ContextProvider.GetJobRunId(),
+                SkipSearch = skipSearch
             };
 
             await _messageBus.Publish(removeRequest);

code/backend/Cleanuparr.Infrastructure/Features/Jobs/MalwareBlocker.cs

@@ -1,4 +1,4 @@
-using Cleanuparr.Domain.Entities.Arr.Queue;
+using Cleanuparr.Domain.Entities.Arr.Queue;
 using Cleanuparr.Domain.Enums;
 using Cleanuparr.Infrastructure.Events.Interfaces;
 using Cleanuparr.Infrastructure.Features.Arr.Interfaces;
@@ -48,9 +48,13 @@ public sealed class MalwareBlocker : GenericHandler
             return;
         }
         
-        var config = ContextProvider.Get<ContentBlockerConfig>();
+        ContentBlockerConfig malwareBlockerConfig = ContextProvider.Get<ContentBlockerConfig>();
         
-        if (!config.Sonarr.Enabled && !config.Radarr.Enabled && !config.Lidarr.Enabled && !config.Readarr.Enabled && !config.Whisparr.Enabled)
+        if (!malwareBlockerConfig.Sonarr.Enabled && 
+            !malwareBlockerConfig.Radarr.Enabled && 
+            !malwareBlockerConfig.Lidarr.Enabled && 
+            !malwareBlockerConfig.Readarr.Enabled && 
+            !malwareBlockerConfig.Whisparr.Enabled)
         {
             _logger.LogWarning("No blocklists are enabled");
             return;
@@ -64,27 +68,27 @@ public sealed class MalwareBlocker : GenericHandler
         var readarrConfig = ContextProvider.Get<ArrConfig>(nameof(InstanceType.Readarr));
         var whisparrConfig = ContextProvider.Get<ArrConfig>(nameof(InstanceType.Whisparr));
 
-        if (config.Sonarr.Enabled || config.DeleteKnownMalware)
+        if (malwareBlockerConfig.Sonarr.Enabled)
         {
             await ProcessArrConfigAsync(sonarrConfig);
         }
-        
-        if (config.Radarr.Enabled || config.DeleteKnownMalware)
+
+        if (malwareBlockerConfig.Radarr.Enabled)
         {
             await ProcessArrConfigAsync(radarrConfig);
         }
-        
-        if (config.Lidarr.Enabled || config.DeleteKnownMalware)
+
+        if (malwareBlockerConfig.Lidarr.Enabled)
         {
             await ProcessArrConfigAsync(lidarrConfig);
         }
-        
-        if (config.Readarr.Enabled || config.DeleteKnownMalware)
+
+        if (malwareBlockerConfig.Readarr.Enabled)
         {
             await ProcessArrConfigAsync(readarrConfig);
         }
-        
-        if (config.Whisparr.Enabled || config.DeleteKnownMalware)
+
+        if (malwareBlockerConfig.Whisparr.Enabled)
         {
             await ProcessArrConfigAsync(whisparrConfig);
         }
@@ -107,33 +111,43 @@ public sealed class MalwareBlocker : GenericHandler
 
         IReadOnlyList<IDownloadService> downloadServices = await GetInitializedDownloadServicesAsync();
         
+        var config = ContextProvider.Get<ContentBlockerConfig>();
+
         await _arrArrQueueIterator.Iterate(arrClient, instance, async items =>
         {
             var groups = items
                 .GroupBy(x => x.DownloadId)
                 .ToList();
-            
+
             foreach (var group in groups)
             {
-                if (group.Any(x => !arrClient.IsRecordValid(x)))
-                {
-                    continue;
-                }
-                
                 QueueRecord record = group.First();
-                
-                _logger.LogTrace("processing | {title} | {id}", record.Title, record.DownloadId);
-                
+
                 if (!arrClient.IsRecordValid(record))
                 {
                     continue;
                 }
-                
+
                 if (ignoredDownloads.Contains(record.DownloadId, StringComparer.InvariantCultureIgnoreCase))
                 {
                     _logger.LogInformation("skip | {title} | ignored", record.Title);
                     continue;
                 }
+
+                _logger.LogTrace("processing | {title} | {id}", record.Title, record.DownloadId);
+                
+                bool hasContentId = arrClient.HasContentId(record);
+
+                if (!hasContentId)
+                {
+                    if (!config.ProcessNoContentId)
+                    {
+                        _logger.LogInformation("skip | item is missing the content id | {title}", record.Title);
+                        continue;
+                    }
+                    
+                    _logger.LogDebug("item is missing the content id | {title}", record.Title);
+                }
                 
                 string downloadRemovalKey = CacheKeys.DownloadMarkedForRemoval(record.DownloadId, instance.Url);
                 
@@ -196,8 +210,6 @@ public sealed class MalwareBlocker : GenericHandler
                     continue;
                 }
                 
-                var config = ContextProvider.Get<ContentBlockerConfig>();
-                
                 bool removeFromClient = true;
                 
                 if (result.IsPrivate && !config.DeletePrivate)
@@ -212,7 +224,8 @@ public sealed class MalwareBlocker : GenericHandler
                     record,
                     group.Count() > 1,
                     removeFromClient,
-                    result.DeleteReason
+                    result.DeleteReason,
+                    skipSearch: !hasContentId
                 );
             }
         });

code/backend/Cleanuparr.Infrastructure/Features/Jobs/QueueCleaner.cs

@@ -106,18 +106,11 @@ public sealed class QueueCleaner : GenericHandler
             var groups = items
                 .GroupBy(x => x.DownloadId)
                 .ToList();
-            
+
             foreach (var group in groups)
             {
-                if (group.Any(x => !arrClient.IsRecordValid(x)))
-                {
-                    continue;
-                }
-                
                 QueueRecord record = group.First();
-                
-                _logger.LogTrace("processing | {title} | {id}", record.Title, record.DownloadId);
-                
+
                 if (!arrClient.IsRecordValid(record))
                 {
                     continue;
@@ -129,6 +122,21 @@ public sealed class QueueCleaner : GenericHandler
                     continue;
                 }
                 
+                _logger.LogDebug("processing | {title} | {id}", record.Title, record.DownloadId);
+                
+                bool hasContentId = arrClient.HasContentId(record);
+
+                if (!hasContentId)
+                {
+                    if (!queueCleanerConfig.ProcessNoContentId)
+                    {
+                        _logger.LogInformation("skip | item is missing the content id | {title}", record.Title);
+                        continue;
+                    }
+                    
+                    _logger.LogDebug("item is missing the content id | {title}", record.Title);
+                }
+                
                 string downloadRemovalKey = CacheKeys.DownloadMarkedForRemoval(record.DownloadId, instance.Url);
                 
                 if (_cache.TryGetValue(downloadRemovalKey, out bool _))
@@ -190,7 +198,8 @@ public sealed class QueueCleaner : GenericHandler
                         record,
                         group.Count() > 1,
                         removeFromClient,
-                        downloadCheckResult.DeleteReason
+                        downloadCheckResult.DeleteReason,
+                        skipSearch: !hasContentId
                     );
 
                     continue;
@@ -218,7 +227,8 @@ public sealed class QueueCleaner : GenericHandler
                         record,
                         group.Count() > 1,
                         removeFromClient,
-                        DeleteReason.FailedImport
+                        DeleteReason.FailedImport,
+                        skipSearch: !hasContentId
                     );
 
                     continue;

code/backend/Cleanuparr.Infrastructure/Features/MalwareBlocker/BlocklistProvider.cs

@@ -23,8 +23,6 @@ public sealed class BlocklistProvider : IBlocklistProvider
     private readonly Dictionary<string, DateTime> _lastLoadTimes = new();
     private const int DefaultLoadIntervalHours = 4;
     private const int FastLoadIntervalMinutes = 5;
-    private const string MalwareListUrl = "https://cleanuparr.pages.dev/static/known_malware_file_name_patterns";
-    private const string MalwareListKey = "MALWARE_PATTERNS";
 
     public BlocklistProvider(
         ILogger<BlocklistProvider> logger,
@@ -72,10 +70,7 @@ public sealed class BlocklistProvider : IBlocklistProvider
                     changedCount++;
                 }
             }
-            
-            // Always check and update malware patterns
-            await LoadMalwarePatternsAsync(fileReader);
-            
+
             if (changedCount > 0)
             {
                 _logger.LogInformation("Successfully loaded {count} blocklists", changedCount);
@@ -109,17 +104,10 @@ public sealed class BlocklistProvider : IBlocklistProvider
     public ConcurrentBag<Regex> GetRegexes(InstanceType instanceType)
     {
         _cache.TryGetValue(CacheKeys.BlocklistRegexes(instanceType), out ConcurrentBag<Regex>? regexes);
-        
+
         return regexes ?? [];
     }
-    
-    public ConcurrentBag<string> GetMalwarePatterns()
-    {
-        _cache.TryGetValue(CacheKeys.KnownMalwarePatterns(), out ConcurrentBag<string>? patterns);
-        
-        return patterns ?? [];
-    }
-    
+
     private async Task<bool> EnsureInstanceLoadedAsync(BlocklistSettings settings, InstanceType instanceType, FileReader fileReader)
     {
         if (!settings.Enabled || string.IsNullOrEmpty(settings.BlocklistPath))
@@ -165,47 +153,9 @@ public sealed class BlocklistProvider : IBlocklistProvider
         {
             return true;
         }
-        
+
         return DateTime.UtcNow - lastLoad >= interval;
     }
-    
-    private async Task LoadMalwarePatternsAsync(FileReader fileReader)
-    {
-        var malwareInterval = TimeSpan.FromMinutes(FastLoadIntervalMinutes);
-        
-        if (!ShouldReloadBlocklist(MalwareListKey, malwareInterval))
-        {
-            return;
-        }
-        
-        try
-        {
-            _logger.LogDebug("Loading malware patterns");
-            
-            string[] filePatterns = await fileReader.ReadContentAsync(MalwareListUrl);
-            
-            long startTime = Stopwatch.GetTimestamp();
-            ParallelOptions options = new() { MaxDegreeOfParallelism = 5 };
-            ConcurrentBag<string> patterns = [];
-            
-            Parallel.ForEach(filePatterns, options, pattern =>
-            {
-                patterns.Add(pattern);
-            });
-
-            TimeSpan elapsed = Stopwatch.GetElapsedTime(startTime);
-
-            _cache.Set(CacheKeys.KnownMalwarePatterns(), patterns);
-            _lastLoadTimes[MalwareListKey] = DateTime.UtcNow;
-            
-            _logger.LogDebug("loaded {count} known malware patterns", patterns.Count);
-            _logger.LogDebug("malware patterns loaded in {elapsed} ms", elapsed.TotalMilliseconds);
-        }
-        catch (Exception ex)
-        {
-            _logger.LogWarning(ex, "Failed to load malware patterns from {url}", MalwareListUrl);
-        }
-    }
 
     private async Task LoadPatternsAndRegexesAsync(BlocklistSettings blocklistSettings, InstanceType instanceType, FileReader fileReader)
     {

code/backend/Cleanuparr.Infrastructure/Features/MalwareBlocker/FilenameEvaluator.cs

@@ -20,16 +20,6 @@ public class FilenameEvaluator : IFilenameEvaluator
         return IsValidAgainstPatterns(filename, type, patterns) && IsValidAgainstRegexes(filename, type, regexes);
     }
 
-    public bool IsKnownMalware(string filename, ConcurrentBag<string> malwarePatterns)
-    {
-        if (malwarePatterns.Count is 0)
-        {
-            return false;
-        }
-        
-        return malwarePatterns.Any(pattern => filename.Contains(pattern, StringComparison.InvariantCultureIgnoreCase));
-    }
-
     private static bool IsValidAgainstPatterns(string filename, BlocklistType type, ConcurrentBag<string> patterns)
     {
         if (patterns.Count is 0)

code/backend/Cleanuparr.Infrastructure/Features/MalwareBlocker/IBlocklistProvider.cs

@@ -13,6 +13,4 @@ public interface IBlocklistProvider
     ConcurrentBag<string> GetPatterns(InstanceType instanceType);
     
     ConcurrentBag<Regex> GetRegexes(InstanceType instanceType);
-    
-    ConcurrentBag<string> GetMalwarePatterns();
 }

code/backend/Cleanuparr.Infrastructure/Features/MalwareBlocker/IFilenameEvaluator.cs

@@ -7,6 +7,4 @@ namespace Cleanuparr.Infrastructure.Features.MalwareBlocker;
 public interface IFilenameEvaluator
 {
     bool IsValid(string filename, BlocklistType type, ConcurrentBag<string> patterns, ConcurrentBag<Regex> regexes);
-
-    bool IsKnownMalware(string filename, ConcurrentBag<string> malwarePatterns);
 }

code/backend/Cleanuparr.Infrastructure/Helpers/CacheKeys.cs

@@ -8,8 +8,6 @@ public static class CacheKeys
     public static string BlocklistPatterns(InstanceType instanceType) => $"{instanceType.ToString()}_patterns";
     public static string BlocklistRegexes(InstanceType instanceType) => $"{instanceType.ToString()}_regexes";
 
-    public static string KnownMalwarePatterns() => "KNOWN_MALWARE_PATTERNS";
-
     public static string IgnoredDownloads(string name) => $"{name}_ignored";
     
     public static string DownloadMarkedForRemoval(string hash, Uri url) => $"remove_{hash.ToLowerInvariant()}_{url}";

code/backend/Cleanuparr.Persistence/DataContext.cs

@@ -88,11 +88,20 @@ public class DataContext : DbContext
     protected override void OnModelCreating(ModelBuilder modelBuilder)
     {
         modelBuilder.Entity<GeneralConfig>(entity =>
+        {
             entity.ComplexProperty(e => e.Log, cp =>
             {
                 cp.Property(l => l.Level).HasConversion<LowercaseEnumConverter<LogEventLevel>>();
-            })
-        );
+            });
+
+            entity.ComplexProperty(e => e.Auth, cp =>
+            {
+                cp.Property(a => a.TrustedNetworks)
+                    .HasConversion(
+                        v => string.Join(',', v),
+                        v => v.Split(',', StringSplitOptions.RemoveEmptyEntries).ToList());
+            });
+        });
         
         modelBuilder.Entity<QueueCleanerConfig>(entity =>
         {

code/backend/Cleanuparr.Persistence/Migrations/Data/20260223085409_AddAuthConfig.cs

@@ -0,0 +1,51 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Cleanuparr.Persistence.Migrations.Data
+{
+    /// <inheritdoc />
+    public partial class AddAuthConfig : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<bool>(
+                name: "auth_disable_auth_for_local_addresses",
+                table: "general_configs",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "auth_trust_forwarded_headers",
+                table: "general_configs",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<string>(
+                name: "auth_trusted_networks",
+                table: "general_configs",
+                type: "TEXT",
+                nullable: false,
+                defaultValue: "");
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "auth_disable_auth_for_local_addresses",
+                table: "general_configs");
+
+            migrationBuilder.DropColumn(
+                name: "auth_trust_forwarded_headers",
+                table: "general_configs");
+
+            migrationBuilder.DropColumn(
+                name: "auth_trusted_networks",
+                table: "general_configs");
+        }
+    }
+}

code/backend/Cleanuparr.Persistence/Migrations/Data/20260306140714_AddProcessMissingContentId.cs

@@ -0,0 +1,40 @@
+using Microsoft.EntityFrameworkCore.Migrations;
+
+#nullable disable
+
+namespace Cleanuparr.Persistence.Migrations.Data
+{
+    /// <inheritdoc />
+    public partial class AddProcessMissingContentId : Migration
+    {
+        /// <inheritdoc />
+        protected override void Up(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.AddColumn<bool>(
+                name: "process_no_content_id",
+                table: "queue_cleaner_configs",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+
+            migrationBuilder.AddColumn<bool>(
+                name: "process_no_content_id",
+                table: "content_blocker_configs",
+                type: "INTEGER",
+                nullable: false,
+                defaultValue: false);
+        }
+
+        /// <inheritdoc />
+        protected override void Down(MigrationBuilder migrationBuilder)
+        {
+            migrationBuilder.DropColumn(
+                name: "process_no_content_id",
+                table: "queue_cleaner_configs");
+
+            migrationBuilder.DropColumn(
+                name: "process_no_content_id",
+                table: "content_blocker_configs");
+        }
+    }
+}