Some checks just to be safe + link to the project

src/enrich.rs

@@ -1220,6 +1220,13 @@ pub fn enrich_by_mbid(
     mbid: &str,
     cover_url_override: Option<&str>,
 ) {
+    // Reject MBIDs that contain path-traversal sequences or directory
+    // separators — a valid UUID contains only hex digits and hyphens.
+    if mbid.contains("..") || mbid.contains('/') || mbid.contains('\\') {
+        eprintln!("[error] Invalid MBID '{}': must not contain path components.", mbid);
+        return;
+    }
+
     let client = build_client();
     let covers = covers_dir();
 

src/mpd.rs

@@ -1120,6 +1120,19 @@ pub fn run_mpd_cover_revalidate(config: &MpdConfig, conn: &Connection, artist: O
         };
 
         let dest = Path::new(&album.cover_url);
+
+        // Sanity-check: only write to paths inside the scrbblr covers
+        // directory. Rejects any DB row whose cover_url was tampered with to
+        // point outside our own data directory.
+        if !dest.starts_with(enrich::covers_dir()) {
+            eprintln!(
+                "  [warn] cover_url '{}' is outside the covers directory; skipping.",
+                album.cover_url
+            );
+            skipped += 1;
+            continue;
+        }
+
         let needs_repair = match std::fs::read(dest) {
             Ok(existing) => existing != processed,
             Err(_) => true,

src/report.rs

@@ -813,7 +813,7 @@ pub fn render_html_report(conn: &Connection, limit: i64, all_time_limit: i64) ->
     h.open("<div class=\"hero\">");
     h.line("<h1>Listening Report</h1>");
     h.linef(format_args!(
-        "<div class=\"sub\">Generated by scrbblr on {}</div>",
+        "<div class=\"sub\">Generated by <a href=\"https://github.com/arturmeski/scrbblr\">scrbblr</a> on {}</div>",
         html_escape(&generated_at)
     ));
     h.close("</div>");