See https://www.reddit.com/r/selfhosted/comments/1rckopd/huntarr_your_passwords_and_your_entire_arr_stacks/

TLDR: huntarr was vibe-coded and had tons of security issues. When the “developer” was confronted, he nuked the git repo, his github account and all his social media accounts.

I’m a little late here but I can explain it.

What Sonarr, Radarr and the others do automatically is scan an RSS feed of new releases. Basically, they look through the things that were uploaded to each tracker, since the last scan, to see if anything should be downloaded. The issue with this is that this only finds the things that were uploaded since the media item (show or movie) was added, not things that were uploaded before then. What this software does (and Huntarr used to do) is run a full search on the indexers, so the *arr apps can find any file that has ever been uploaded to the trackers. It’s the same search you can trigger manually.

Technically, adding a media item, manually triggering a full search once and then relying on the automatic RSS scan should give you the same result (unless any trackers were down while you ran the manual search, which is one of the issues with this approach) but, for example, I use Seerr, so friends and family can add new stuff to my *arr apps but Seerr doesn’t trigger a full search when something gets added, so I would have to manually trigger the full search once every time someone adds something. The point of having something like Fetcharr is that the full search gets triggered automatically. In addition, it does so periodically instead of just once, so that fixes issues like trackers being down when the search was triggered or a download not being found in the RSS feed despite it existing (not sure if the second one ever happens but it technically could and this would solve that issue).

Edit: I also just saw that the GitHub page for this has an explanation as well:

I learned that at *arr stack uses RSS feeds to scan for and fetch updates, so if your indexer doesn’t support those feeds or the feeds or too old (or a myriad of other issues that can come from this kind of system) then you won’t get replacement content even if it exists. This is why these kinds of “hunting”, “fetching”, “upgrading”, etc systems work so well. They simply force the *arr apps to periodically update their content through their configured indexer, regardless of RSS feed availability.

it’s today’s trend! One I happen to agree with, which is nice.

I’m trying to limit LLM exposure on this one to “as little as possible, within reason”. It’s still a tool and can be used effectively in some areas.

Not sure what you mean by that. I occasionally use the web UI as the tool that it is and I’ve played around with opencode, cursor, etc previously on other home projects to get a sense for where things are and what the limits of these things are. That said, I take pride in my own work and this project is no exception. Is there something in this project that makes you think I threw a prompt into cursor and am passing that off as my own? Or are you against the idea of using an LLM and consider any person or project using them at all to be vibecoded?

As a quick edit, I’ll note that, since I documented any use of ChatGPT reasonably well in this project, you can see the number of times it was used and what it provided. I feel the contributions were largely inconsequential and really just time-saving on my end. I also vetted (and understood!) the output and modified it according to what I wanted. Personally, I don’t consider that to be “vibe-coding” but I suppose everyone has their own definition.

Edit again: ugh, it’s far too easy to focus on negative feedback and let that consume you. I am not going to defend my use of ChatGPT but I personally think that someone seeing the word ChatGPT and saying “oh so this is vibe-coded” is disingenuous to the project and my skills as a developer. I spent years learning and mastering Java and this is a lot of my experience and several weekends of my free time. Look, if you feel that the four uses of ChatGPT, much of which have been modified by my own hand and all of which inconsequential, constitutes a vibe-coded system then that’s your take - but I don’t think it’s a fair take. There are many things to be said about the ethics of modern LLMs and over-reliance on them but personally I think understanding and effectively using tools at your disposal is a skill. If you want something completely free of LLMs these days you may very well have to invent the universe.

Phew. Okay, I’m off my soap-box. Consider me got. I’ll try not to think about this too hard but it definitely feels bad pouring your time and skills into a thing and seeing that one comment saying “nah this isn’t worth anything”