diff --git a/README.md b/README.md
index 0844c2b1..60ad72ee 100644
--- a/README.md
+++ b/README.md
@@ -131,7 +131,8 @@ services:
     environment:
       - ADMIN_USERNAME=your-admin-username
       - ADMIN_PASSWORD=your-admin-password
-      - SECRET_KEY=replace_with_random_string_can_be_anything
+      # A key for signing login cookies is generated on first start and kept in
+      # /data, so there is nothing to set here. See docs/Security.md
       # The domain your instance is hosted at. e.x: demo.fireshare.net
       # this is required for opengraph to work correctly for shared links.
       - DOMAIN=
diff --git a/app/client/src/components/admin/ImageFileManager.js b/app/client/src/components/admin/ImageFileManager.js
index 64acbcf8..d91a77f2 100644
--- a/app/client/src/components/admin/ImageFileManager.js
+++ b/app/client/src/components/admin/ImageFileManager.js
@@ -34,6 +34,7 @@ import SearchIcon from '@mui/icons-material/Search'
 import FolderIcon from '@mui/icons-material/Folder'
 import OpenInNewIcon from '@mui/icons-material/OpenInNew'
 import LockIcon from '@mui/icons-material/Lock'
+import PersonIcon from '@mui/icons-material/Person'
 import LockOpenIcon from '@mui/icons-material/LockOpen'
 import RefreshIcon from '@mui/icons-material/Refresh'
 import KeyboardArrowDownIcon from '@mui/icons-material/KeyboardArrowDown'
@@ -305,6 +306,9 @@ export default function ImageFileManager({ setAlert }) {
   const [moveModalOpen, setMoveModalOpen] = useState(false)
   const [createFolderDialogOpen, setCreateFolderDialogOpen] = useState(false)
   const [renameDialogOpen, setRenameDialogOpen] = useState(false)
+  const [uploaderDialogOpen, setUploaderDialogOpen] = useState(false)
+  const [uploaderChoice, setUploaderChoice] = useState(null)
+  const [uploaderOptions, setUploaderOptions] = useState([])
   const [colVisAnchor, setColVisAnchor] = useState(null)
 
   // Rename form state
@@ -493,7 +497,7 @@ export default function ImageFileManager({ setAlert }) {
       setActionLoading(true)
       try {
         const { data } = await Api().post(endpoint, body)
-        const updatedCount = (data.updated ?? data.moved ?? data.deleted ?? []).length
+        const updatedCount = data.updated_images ?? (data.updated ?? data.moved ?? data.deleted ?? []).length
         const errorCount = (data.errors ?? []).length
         if (errorCount > 0) {
           setAlert({
@@ -597,6 +601,23 @@ export default function ImageFileManager({ setAlert }) {
     }
   }
 
+  useEffect(() => {
+    if (!uploaderDialogOpen) return
+    Api()
+      .get('/api/admin/uploaders')
+      .then((res) => setUploaderOptions(res.data.users || []))
+      .catch(() => setUploaderOptions([]))
+  }, [uploaderDialogOpen])
+
+  const handleSetUploader = async () => {
+    const ok = await runBulkAction(
+      '/api/admin/image-files/bulk-set-uploader',
+      { image_ids: [...selected], username: uploaderChoice },
+      uploaderChoice ? `Attributed to ${uploaderChoice}` : 'Uploader cleared',
+    )
+    if (ok) setUploaderDialogOpen(false)
+  }
+
   const handleSetPrivacy = async (isPrivate) => {
     await runBulkAction(
       '/api/admin/image-files/bulk-set-privacy',
@@ -709,6 +730,26 @@ export default function ImageFileManager({ setAlert }) {
                   </IconButton>
                 </span>
               </Tooltip>
+              <Tooltip title="Set uploader">
+                <span>
+                  <IconButton
+                    size="small"
+                    disabled={onlyEmptyFoldersSelected}
+                    onClick={() => {
+                      setUploaderChoice(null)
+                      setUploaderDialogOpen(true)
+                    }}
+                    sx={{
+                      border: '1px solid #3399FF44',
+                      borderRadius: 1,
+                      color: '#7FBFFF',
+                      '&:hover': { bgcolor: '#3399FF12' },
+                    }}
+                  >
+                    <PersonIcon sx={{ fontSize: 20 }} />
+                  </IconButton>
+                </span>
+              </Tooltip>
               <Tooltip title="Rename">
                 <span>
                   <IconButton
@@ -810,6 +851,28 @@ export default function ImageFileManager({ setAlert }) {
                     </Button>
                   </span>
                 </Tooltip>
+                <Tooltip title="Attribute selected images to a user">
+                  <span>
+                    <Button
+                      size="small"
+                      variant="outlined"
+                      disabled={onlyEmptyFoldersSelected}
+                      startIcon={<PersonIcon />}
+                      onClick={() => {
+                        setUploaderChoice(null)
+                        setUploaderDialogOpen(true)
+                      }}
+                      sx={{
+                        textTransform: 'none',
+                        borderColor: '#3399FF44',
+                        color: '#7FBFFF',
+                        '&:hover': { borderColor: '#3399FF99', bgcolor: '#3399FF12' },
+                      }}
+                    >
+                      Uploader
+                    </Button>
+                  </span>
+                </Tooltip>
                 <Tooltip title="Rename selected images">
                   <span>
                     <Button
@@ -1695,6 +1758,55 @@ export default function ImageFileManager({ setAlert }) {
           </Button>
         </DialogActions>
       </Dialog>
+
+      {/* ── Set Uploader modal ── */}
+      <Dialog
+        open={uploaderDialogOpen}
+        onClose={() => !actionLoading && setUploaderDialogOpen(false)}
+        fullWidth
+        maxWidth="xs"
+        PaperProps={{ sx: dialogPaperSx }}
+      >
+        <DialogTitle sx={dialogTitleSx}>Set uploader</DialogTitle>
+        <DialogContent>
+          <DialogContentText sx={{ color: '#FFFFFFAA', fontSize: 13.5, mb: 2 }}>
+            Attribute {selected.size} selected image{selected.size === 1 ? '' : 's'} to an account.
+            This is how library content indexed from disk gets an owner, so it appears on their
+            profile and comes under their edit and delete permissions.
+          </DialogContentText>
+          <Select
+            options={[
+              { value: null, label: 'No uploader (unattributed)' },
+              ...uploaderOptions.map((u) => ({
+                value: u.username,
+                label: u.name === u.username ? `@${u.username}` : `${u.name} (@${u.username})`,
+              })),
+            ]}
+            value={
+              uploaderChoice === null
+                ? { value: null, label: 'No uploader (unattributed)' }
+                : uploaderOptions
+                    .filter((u) => u.username === uploaderChoice)
+                    .map((u) => ({
+                      value: u.username,
+                      label: u.name === u.username ? `@${u.username}` : `${u.name} (@${u.username})`,
+                    }))[0] || null
+            }
+            onChange={(opt) => setUploaderChoice(opt ? opt.value : null)}
+            styles={selectFolderTheme}
+            menuPortalTarget={document.body}
+            placeholder="Choose an account..."
+          />
+        </DialogContent>
+        <DialogActions sx={{ px: 3, pb: 2, gap: 1 }}>
+          <Button onClick={() => setUploaderDialogOpen(false)} disabled={actionLoading} sx={{ color: '#B2BAC2' }}>
+            Cancel
+          </Button>
+          <Button onClick={handleSetUploader} variant="contained" disabled={actionLoading}>
+            {actionLoading ? 'Applying...' : 'Apply'}
+          </Button>
+        </DialogActions>
+      </Dialog>
     </Box>
   )
 }
diff --git a/app/client/src/components/admin/VideoFileManager.js b/app/client/src/components/admin/VideoFileManager.js
index 714b4387..866f3a9c 100644
--- a/app/client/src/components/admin/VideoFileManager.js
+++ b/app/client/src/components/admin/VideoFileManager.js
@@ -636,7 +636,7 @@ export default function VideoFileManager({ setAlert }) {
       setActionLoading(true)
       try {
         const { data } = await Api().post(endpoint, body)
-        const updatedCount = (data.updated ?? data.moved ?? data.deleted ?? []).length
+        const updatedCount = data.updated_videos ?? (data.updated ?? data.moved ?? data.deleted ?? []).length
         const errorCount = (data.errors ?? []).length
         if (errorCount > 0) {
           setAlert({
diff --git a/app/client/src/components/forms/LoginForm.js b/app/client/src/components/forms/LoginForm.js
index 11fdfcff..6d2a7656 100644
--- a/app/client/src/components/forms/LoginForm.js
+++ b/app/client/src/components/forms/LoginForm.js
@@ -74,10 +74,12 @@ const LoginForm = function () {
       await completeLogin()
     } catch (err) {
       const status = err.response?.status
+      // 429 carries the throttle's own "try again in N seconds" text, which is the
+      // only way the user finds out why a correct password is being refused.
+      const showsServerMessage = status === 401 || status === 403 || status === 429
       setAlert({
-        type: status === 401 ? 'warning' : 'error',
-        message:
-          status === 401 || status === 403 ? errorMessage(err) : 'An unknown error occurred while trying to log in.',
+        type: status === 401 || status === 429 ? 'warning' : 'error',
+        message: showsServerMessage ? errorMessage(err) : 'An unknown error occurred while trying to log in.',
         open: true,
       })
       setLoading(false)
diff --git a/app/server/fireshare/__init__.py b/app/server/fireshare/__init__.py
index 3af5a2d4..d865b0f9 100644
--- a/app/server/fireshare/__init__.py
+++ b/app/server/fireshare/__init__.py
@@ -124,7 +124,24 @@ def create_app(init_schedule=False):
     ldap_retired.abort_if_ldap_configured(logger)
 
     app = Flask(__name__, static_url_path='', static_folder='build', template_folder='build')
-    CORS(app, supports_credentials=True)
+
+    # Cross-origin access is off unless an operator names the origins that need it.
+    # It used to be CORS(app, supports_credentials=True) with no origins, which
+    # flask-cors reads as "any origin": it echoed whatever Origin arrived back as
+    # Access-Control-Allow-Origin next to Access-Control-Allow-Credentials: true,
+    # so any site a signed-in user visited could call the API as them. Fireshare
+    # serves its frontend from this same origin, so nothing needs this by default.
+    cors_origins = [o.strip() for o in os.getenv('CORS_ORIGINS', '').split(',') if o.strip()]
+    if '*' in cors_origins:
+        logger.warning(
+            "CORS_ORIGINS=* cannot be combined with credentialed requests and has been "
+            "ignored. List the origins that need access explicitly."
+        )
+        cors_origins = [o for o in cors_origins if o != '*']
+    if cors_origins:
+        CORS(app, supports_credentials=True, origins=cors_origins)
+        logger.info(f"CORS enabled for: {', '.join(cors_origins)}")
+
     if 'DATA_DIRECTORY' not in os.environ:
         raise Exception("DATA_DIRECTORY not found in environment")
 
@@ -132,11 +149,39 @@ def create_app(init_schedule=False):
     app.config['DOMAIN'] = os.getenv('DOMAIN')
     app.config['THUMBNAIL_VIDEO_LOCATION'] = int(os.getenv('THUMBNAIL_VIDEO_LOCATION') or 0)
 
-    app.config['SECRET_KEY'] = os.getenv('SECRET_KEY', secrets.token_hex(32))
+    # Both of these shipped filled in — one in docker-compose.yml, one in the README's
+    # compose example — so instances that never edited the line were signing cookies
+    # with a key published in this repo. A signing key is worth nothing once public,
+    # so treat either as if it were unset.
+    PUBLISHED_SECRET_KEYS = {
+        'replace_this_with_some_random_string',
+        'replace_with_random_string_can_be_anything',
+    }
+    _secret_key = os.getenv('SECRET_KEY') or ''
+    if _secret_key in PUBLISHED_SECRET_KEYS:
+        logger.warning(
+            "SECRET_KEY is set to an example value published in the Fireshare docs. That key "
+            "is public, so it is being ignored in favour of a generated one. Remove the line "
+            "from your compose file; sessions will not survive a restart until you do."
+        )
+        _secret_key = ''
+    app.config['SECRET_KEY'] = _secret_key or secrets.token_hex(32)
 
     from datetime import timedelta
     app.config['PERMANENT_SESSION_LIFETIME'] = timedelta(hours=1)
 
+    # SameSite was never set, leaving both cookies on whatever the browser happened
+    # to default to. Lax is stated explicitly so a cross-site request cannot carry
+    # them regardless of that default. Secure is opt-in because plenty of instances
+    # are reached over plain HTTP on a LAN, where it would lock users out entirely.
+    secure_cookies = env_bool('SECURE_COOKIES')
+    app.config['SESSION_COOKIE_HTTPONLY'] = True
+    app.config['SESSION_COOKIE_SAMESITE'] = 'Lax'
+    app.config['SESSION_COOKIE_SECURE'] = secure_cookies
+    app.config['REMEMBER_COOKIE_HTTPONLY'] = True
+    app.config['REMEMBER_COOKIE_SAMESITE'] = 'Lax'
+    app.config['REMEMBER_COOKIE_SECURE'] = secure_cookies
+
     app.config['DATA_DIRECTORY'] = os.getenv('DATA_DIRECTORY')
     app.config['VIDEO_DIRECTORY'] = os.getenv('VIDEO_DIRECTORY')
     app.config['PROCESSED_DIRECTORY'] = os.getenv('PROCESSED_DIRECTORY')
diff --git a/app/server/fireshare/api/__init__.py b/app/server/fireshare/api/__init__.py
index 44aebdae..05597a83 100644
--- a/app/server/fireshare/api/__init__.py
+++ b/app/server/fireshare/api/__init__.py
@@ -1,9 +1,7 @@
 import os
 from flask import Blueprint
-from flask_cors import CORS
 
 templates_path = os.environ.get('TEMPLATE_PATH') or 'templates'
 api = Blueprint('api', __name__, template_folder=templates_path)
-CORS(api, supports_credentials=True)
 
 from . import transcoding, scan, misc, admin, video, upload, game, tag, image, folder, profile, users  # noqa: E402,F401
diff --git a/app/server/fireshare/api/admin.py b/app/server/fireshare/api/admin.py
index 1e06f9a7..9f960821 100644
--- a/app/server/fireshare/api/admin.py
+++ b/app/server/fireshare/api/admin.py
@@ -18,7 +18,7 @@
 from ..models import Video, VideoInfo, VideoView, GameMetadata, VideoGameLink, VideoTagLink, Image, ImageInfo, ImageGameLink, ImageTagLink, ImageView, TranscodeJob, MediaFolder
 from .. import permissions as perms
 from . import api
-from .helpers import cancel_pending_transcode_jobs, delete_video_files
+from .helpers import cancel_pending_transcode_jobs, delete_video_files, resolve_media_subfolder
 from .transcoding import _is_pid_running
 from .scan import _game_scan_state
 from .decorators import admin_required, demo_restrict
@@ -462,7 +462,10 @@ def bulk_move_files():
 
     paths = current_app.config['PATHS']
     video_path = paths['video']
-    target_folder_path = video_path / target_folder
+    resolved = resolve_media_subfolder(video_path, target_folder)
+    if not resolved:
+        return Response(status=400, response=f"Folder '{target_folder}' is not inside the video directory.")
+    target_folder_path, target_folder = resolved
 
     if not target_folder_path.is_dir():
         return Response(status=400, response=f"Folder '{target_folder}' does not exist.")
@@ -477,7 +480,7 @@ def bulk_move_files():
 
         old_file_path = video_path / video.path
         filename = Path(video.path).name
-        new_path = f"{target_folder}/{filename}"
+        new_path = f"{target_folder}/{filename}" if target_folder else filename
         new_file_path = video_path / new_path
 
         if old_file_path.resolve() == new_file_path.resolve():
@@ -497,7 +500,12 @@ def bulk_move_files():
             os.symlink(new_file_path.absolute(), link_path)
 
             video.path = new_path
-            video.folder_id = _get_or_create_media_folder(target_folder.split('/')[0], "video").id
+            # Media sitting directly in the root carries no folder row, matching how
+            # the disk scan records it.
+            video.folder_id = (
+                _get_or_create_media_folder(target_folder.split('/')[0], "video").id
+                if target_folder else None
+            )
 
             from ..models import FolderRule
             folder_rule = FolderRule.query.filter_by(folder_path=target_folder).first()
@@ -1045,7 +1053,10 @@ def bulk_move_images():
         return Response(status=503, response='IMAGE_DIRECTORY is not configured.')
 
     image_path = Path(image_directory)
-    target_folder_path = image_path / target_folder
+    resolved = resolve_media_subfolder(image_path, target_folder)
+    if not resolved:
+        return Response(status=400, response=f"Folder '{target_folder}' is not inside the image directory.")
+    target_folder_path, target_folder = resolved
     paths = current_app.config['PATHS']
 
     if not target_folder_path.is_dir():
@@ -1061,7 +1072,7 @@ def bulk_move_images():
 
         old_file_path = image_path / img.path
         filename = Path(img.path).name
-        new_path = f"{target_folder}/{filename}"
+        new_path = f"{target_folder}/{filename}" if target_folder else filename
         new_file_path = image_path / new_path
 
         if old_file_path.resolve() == new_file_path.resolve():
@@ -1081,7 +1092,10 @@ def bulk_move_images():
             os.symlink(new_file_path.absolute(), link_path)
 
             img.path = new_path
-            img.folder_id = _get_or_create_media_folder(target_folder.split('/')[0], "image").id
+            img.folder_id = (
+                _get_or_create_media_folder(target_folder.split('/')[0], "image").id
+                if target_folder else None
+            )
             db.session.commit()
             results['moved'].append(img_id)
         except Exception as e:
diff --git a/app/server/fireshare/api/game.py b/app/server/fireshare/api/game.py
index 4d168297..487fe753 100644
--- a/app/server/fireshare/api/game.py
+++ b/app/server/fireshare/api/game.py
@@ -53,6 +53,7 @@ def game_json_with_assets(game):
 
 
 @api.route('/api/steamgrid/search', methods=["GET"])
+@login_required
 def search_steamgrid():
     query = request.args.get('query')
     if not query:
@@ -69,6 +70,7 @@ def search_steamgrid():
 
 
 @api.route('/api/steamgrid/game/<int:game_id>/assets', methods=["GET"])
+@login_required
 def get_steamgrid_assets(game_id):
     api_key = get_steamgriddb_api_key()
     if not api_key:
@@ -81,6 +83,7 @@ def get_steamgrid_assets(game_id):
 
 
 @api.route('/api/steamgrid/game/<int:game_id>/assets/options', methods=["GET"])
+@login_required
 def get_steamgrid_asset_options(game_id):
     api_key = get_steamgriddb_api_key()
     if not api_key:
diff --git a/app/server/fireshare/api/helpers.py b/app/server/fireshare/api/helpers.py
index 4e122897..094eb9d5 100644
--- a/app/server/fireshare/api/helpers.py
+++ b/app/server/fireshare/api/helpers.py
@@ -5,6 +5,7 @@
 import shutil
 import time
 from functools import wraps
+from pathlib import Path
 from flask import current_app
 from .. import db, logger
 from ..models import TranscodeJob, Video
@@ -35,6 +36,33 @@ def sanitize_upload_folder(name):
     return folder or None
 
 
+def resolve_media_subfolder(root, folder):
+    """Join a client-supplied folder onto a media root without letting it escape.
+
+    The move endpoints accept nested folders, so the single-level
+    sanitize_upload_folder() above is too strict for them; what has to hold is only
+    that the result stays inside the root. Both ways out need closing: pathlib's `/`
+    operator discards the root entirely when the right-hand side is absolute
+    ("/etc"), and a relative "../" walks out of it just as effectively.
+
+    The comparison is deliberately lexical. Resolving symlinks would also reject a
+    folder the operator symlinked into their media directory, which is a supported
+    way to lay a library out, and nothing reachable over the API can create a
+    symlink inside the root for an attacker to aim at.
+
+    Returns (absolute_path, folder_relative_to_root) with the folder normalised, or
+    None when it escapes the root.
+    """
+    if folder is None:
+        return None
+    root_str = os.path.normpath(str(root))
+    candidate = os.path.normpath(os.path.join(root_str, str(folder)))
+    if candidate != root_str and not candidate.startswith(root_str + os.sep):
+        return None
+    relative = os.path.relpath(candidate, root_str)
+    return Path(candidate), ('' if relative == '.' else Path(relative).as_posix())
+
+
 def remove_derived_dir(derived_path, attempts=4, delay=0.25):
     """Remove a derived/<id> directory, tolerating jobs that are still writing into it.
 
diff --git a/app/server/fireshare/api/misc.py b/app/server/fireshare/api/misc.py
index 9f67c17c..920069ad 100644
--- a/app/server/fireshare/api/misc.py
+++ b/app/server/fireshare/api/misc.py
@@ -11,7 +11,7 @@
 from ..models import Video, VideoInfo
 from ..cli import send_discord_webhook, send_generic_webhook
 from . import api
-from .decorators import admin_required, demo_restrict
+from .decorators import admin_required, demo_restrict, strict_admin_required
 
 
 # Cache for local app version and release list (persists until server restart)
@@ -253,7 +253,7 @@ def rss_feed():
 
 
 @api.route('/api/test-discord-webhook', methods=['POST'])
-@admin_required
+@strict_admin_required
 @demo_restrict
 def test_discord_webhook():
     data = request.get_json()
@@ -277,7 +277,7 @@ def test_discord_webhook():
 
 
 @api.route('/api/test-webhook', methods=['POST'])
-@admin_required
+@strict_admin_required
 @demo_restrict
 def test_webhook():
     data = request.get_json()
diff --git a/app/server/fireshare/api/video.py b/app/server/fireshare/api/video.py
index e370510e..4130370b 100644
--- a/app/server/fireshare/api/video.py
+++ b/app/server/fireshare/api/video.py
@@ -28,6 +28,7 @@
     cancel_pending_transcode_jobs,
     delete_video_files,
     get_video_path,
+    resolve_media_subfolder,
     viewer_sees_private,
 )
 from .decorators import demo_restrict, require_perm
@@ -501,13 +502,16 @@ def move_video(id):
     paths = current_app.config['PATHS']
     video_path = paths['video']
 
-    target_folder_path = video_path / target_folder
+    resolved = resolve_media_subfolder(video_path, target_folder)
+    if not resolved:
+        return Response(status=400, response=f"Folder '{target_folder}' is not inside the video directory.")
+    target_folder_path, target_folder = resolved
     if not target_folder_path.is_dir():
         return Response(status=400, response=f"Folder '{target_folder}' does not exist.")
 
     old_file_path = video_path / video.path
     filename = Path(video.path).name
-    new_path = f"{target_folder}/{filename}"
+    new_path = f"{target_folder}/{filename}" if target_folder else filename
     new_file_path = video_path / new_path
 
     if old_file_path.resolve() == new_file_path.resolve():
@@ -589,9 +593,20 @@ def handle_video_details(id):
             new_start = data.pop('start_time', _UNSET)
             new_end   = data.pop('end_time',   _UNSET)
 
-            # Update remaining VideoInfo fields generically
-            if data:
-                db.session.query(VideoInfo).filter_by(video_id=id).update(data)
+            # Only these are the client's to set. The previous blanket update of
+            # whatever remained in the body also reached video_id (which carries no
+            # uniqueness constraint, so a row could be repointed at someone else's
+            # video) and password_hash (writable as a raw string, side-stepping the
+            # hashing directly below).
+            editable = {
+                field: data[field]
+                for field in ('title', 'description', 'private')
+                if field in data
+            }
+            if 'private' in editable:
+                editable['private'] = bool(editable['private'])
+            if editable:
+                db.session.query(VideoInfo).filter_by(video_id=id).update(editable)
 
             # Handle password changes
             generated_password = None
diff --git a/app/server/fireshare/auth.py b/app/server/fireshare/auth.py
index 47074adc..e9548f67 100644
--- a/app/server/fireshare/auth.py
+++ b/app/server/fireshare/auth.py
@@ -6,7 +6,6 @@
 import qrcode
 from flask import Blueprint, redirect, request, Response, jsonify, current_app, session
 from flask_login import login_user, logout_user, current_user, login_required
-from flask_cors import CORS
 from werkzeug.security import generate_password_hash, check_password_hash
 from .models import User
 from . import db
@@ -14,10 +13,10 @@
 from .api.misc import _get_local_version, _fetch_release_notes
 from .api.decorators import demo_restrict
 from .ip_whitelist import login_ip_required, get_client_ip, is_ip_permitted
+from . import login_throttle
 from datetime import datetime, timezone
 
 auth = Blueprint('auth', __name__)
-CORS(auth, supports_credentials=True)
 
 MFA_PENDING_MAX_AGE = 300
 MFA_MAX_ATTEMPTS = 5
@@ -26,6 +25,7 @@ def _clear_mfa_pending():
     session.pop('mfa_pending_user_id', None)
     session.pop('mfa_pending_at', None)
     session.pop('mfa_attempts', None)
+    session.pop('mfa_username', None)
 
 def _verify_totp(user, code):
     """
@@ -62,6 +62,17 @@ def login():
     if not isinstance(username, str) or not isinstance(password, str):
         return Response(response="Invalid username or password", status=401)
 
+    client_ip = get_client_ip()
+    wait = login_throttle.retry_after(client_ip, username)
+    if wait:
+        # The hash comparison below is deliberately skipped while throttled, so a
+        # blocked caller cannot keep the server doing pbkdf2 work for them.
+        return Response(
+            response=f"Too many failed sign-in attempts. Try again in {wait} seconds.",
+            status=429,
+            headers={'Retry-After': str(wait)},
+        )
+
     user = User.query.filter_by(username=username).first()
 
     # A user awaiting an invite has no password hash, and a disabled account must
@@ -72,12 +83,15 @@ def login():
             session['mfa_pending_user_id'] = user.id
             session['mfa_pending_at'] = time.time()
             session['mfa_attempts'] = 0
+            session['mfa_username'] = user.username
             return jsonify({'mfa_required': True})
         _clear_mfa_pending()
+        login_throttle.clear(client_ip, username)
         login_user(user, remember=True)
         _record_login(user)
         return Response(status=200)
 
+    login_throttle.record_failure(client_ip, username)
     return Response(response="Invalid username or password", status=401)
 
 @auth.route('/api/login/mfa', methods=['POST'])
@@ -92,6 +106,16 @@ def login_mfa():
         _clear_mfa_pending()
         return jsonify({'error': 'Login session expired. Please sign in again.', 'restart': True}), 401
 
+    # The per-session cap above resets whenever the password step is passed again,
+    # so on its own it only ever costs an attacker who already holds the password a
+    # fresh login round per five guesses. Failed codes are therefore counted against
+    # the same address/account budget as failed passwords.
+    client_ip = get_client_ip()
+    pending_username = session.get('mfa_username')
+    wait = login_throttle.retry_after(client_ip, pending_username)
+    if wait:
+        return jsonify({'error': f'Too many failed attempts. Try again in {wait} seconds.'}), 429
+
     user = db.session.get(User, pending_user_id)
     if not user or user.disabled or not user.mfa_enabled or not user.totp_secret:
         _clear_mfa_pending()
@@ -101,11 +125,13 @@ def login_mfa():
 
     matched_step = _verify_totp(user, (request.json or {}).get('code'))
     if matched_step is None:
+        login_throttle.record_failure(client_ip, pending_username)
         return jsonify({'error': 'Invalid authentication code.'}), 401
 
     user.totp_last_used = matched_step
     user.last_login_at = datetime.utcnow()
     db.session.commit()
+    login_throttle.clear(client_ip, pending_username)
     _clear_mfa_pending()
     login_user(user, remember=True)
     return jsonify({'authenticated': True})
diff --git a/app/server/fireshare/login_throttle.py b/app/server/fireshare/login_throttle.py
new file mode 100644
index 00000000..ab4dc9bf
--- /dev/null
+++ b/app/server/fireshare/login_throttle.py
@@ -0,0 +1,106 @@
+"""Throttling for the password step of login.
+
+The MFA step already caps attempts per pending session, but the password check in
+front of it had none, so a known username — most usefully the default `admin` this
+application itself warns operators to change — could be guessed at as fast as the
+server would answer.
+
+Counters live in process memory. Fireshare runs as a single server process per
+instance, so that is enough here and keeps both a rate-limiting dependency and the
+shared store it would normally want out of the deployment. The cost is that
+counters reset if the process restarts, which an attacker cannot force.
+
+Two limits apply together:
+
+* per source IP, which stops the ordinary case of one host working through a
+  password list, and also catches it spraying many usernames at once;
+* per source IP *and* username, which trips sooner on a single targeted account.
+
+Neither is keyed on the username alone, deliberately. A global per-account lockout
+would let anyone on the internet lock a known username — again, most usefully
+`admin` — out of their own instance by failing logins on purpose.
+"""
+
+import threading
+import time
+
+WINDOW_SECONDS = 300
+MAX_FAILURES_PER_IP = 30
+MAX_FAILURES_PER_ACCOUNT = 10
+
+# Bounds the memory an attacker rotating source addresses can cause us to hold.
+# Entries older than the window are dropped first, so this only bites under an
+# active distributed attempt.
+_MAX_TRACKED_KEYS = 4096
+
+_lock = threading.Lock()
+_failures = {}
+
+
+def _ip_key(ip):
+    return f"ip:{ip}"
+
+
+def _account_key(ip, username):
+    return f"account:{ip}|{(username or '').strip().lower()}"
+
+
+def _recent(key, now):
+    """Timestamps for a key inside the window, pruned in place."""
+    stamps = [t for t in _failures.get(key, ()) if t > now - WINDOW_SECONDS]
+    if stamps:
+        _failures[key] = stamps
+    else:
+        _failures.pop(key, None)
+    return stamps
+
+
+def _evict(now):
+    for key in [k for k in _failures if not any(t > now - WINDOW_SECONDS for t in _failures[k])]:
+        del _failures[key]
+    if len(_failures) > _MAX_TRACKED_KEYS:
+        # Keep the most recently active keys; an attacker churning through source
+        # addresses should not be able to push a real offender's counter out.
+        for key in sorted(_failures, key=lambda k: _failures[k][-1])[: len(_failures) - _MAX_TRACKED_KEYS]:
+            del _failures[key]
+
+
+def retry_after(ip, username):
+    """Seconds the caller must wait, or 0 when the attempt may proceed."""
+    now = time.time()
+    with _lock:
+        _evict(now)
+        wait = 0
+        for key, limit in ((_ip_key(ip), MAX_FAILURES_PER_IP),
+                           (_account_key(ip, username), MAX_FAILURES_PER_ACCOUNT)):
+            stamps = _recent(key, now)
+            if len(stamps) >= limit:
+                wait = max(wait, int(stamps[0] + WINDOW_SECONDS - now) + 1)
+        return wait
+
+
+def record_failure(ip, username):
+    now = time.time()
+    with _lock:
+        for key, limit in ((_ip_key(ip), MAX_FAILURES_PER_IP),
+                           (_account_key(ip, username), MAX_FAILURES_PER_ACCOUNT)):
+            stamps = _recent(key, now)
+            stamps.append(now)
+            # A blocked caller that keeps hammering should not grow this without
+            # bound; everything past the limit tells us nothing extra.
+            del stamps[: max(0, len(stamps) - limit)]
+            _failures[key] = stamps
+        _evict(now)
+
+
+def clear(ip, username):
+    """Forget the failures for an address/account pair after a success."""
+    with _lock:
+        _failures.pop(_account_key(ip, username), None)
+        _failures.pop(_ip_key(ip), None)
+
+
+def reset():
+    """Drop all state. For tests."""
+    with _lock:
+        _failures.clear()
diff --git a/app/server/fireshare/main.py b/app/server/fireshare/main.py
index ef341341..1d67d18a 100644
--- a/app/server/fireshare/main.py
+++ b/app/server/fireshare/main.py
@@ -1,13 +1,11 @@
 import os
 from flask import Blueprint, render_template, current_app, redirect
 from flask_login import current_user
-from flask_cors import CORS
 
 templates_path = os.environ.get('TEMPLATE_PATH') or 'templates'
 
 main = Blueprint('main', __name__, template_folder=templates_path)
 
-CORS(main, supports_credentials=True)
 
 
 @main.route('/', defaults={'path': ''})
diff --git a/app/server/fireshare/steamgrid.py b/app/server/fireshare/steamgrid.py
index 5f6ebe9c..00227118 100644
--- a/app/server/fireshare/steamgrid.py
+++ b/app/server/fireshare/steamgrid.py
@@ -6,6 +6,7 @@
 import logging
 from typing import Optional, List, Dict
 from pathlib import Path
+from urllib.parse import quote
 from PIL import Image as PILImage
 
 logger = logging.getLogger(__name__)
@@ -39,7 +40,9 @@ def search_games(self, query: str) -> List[Dict]:
             List of game dictionaries with id, name, release_date
         """
         try:
-            url = f"{self.BASE_URL}/search/autocomplete/{query}"
+            # Escaped: the query reaches here straight from a request parameter, and
+            # unescaped "/" or ".." in it would address a different API path.
+            url = f"{self.BASE_URL}/search/autocomplete/{quote(query, safe='')}"
             response = requests.get(url, headers=self.headers, timeout=10)
             response.raise_for_status()
 
diff --git a/app/server/fireshare/util.py b/app/server/fireshare/util.py
index fd44edaa..21ac49a1 100755
--- a/app/server/fireshare/util.py
+++ b/app/server/fireshare/util.py
@@ -1167,6 +1167,90 @@ def seconds_to_dur_string(sec):
     else:
         return ':'.join([str(mins), str(s).zfill(2)])
 
+def _case_affinity(candidate, query):
+    """How strongly a candidate's own casing is echoed by the query.
+
+    Only ever used to break a tie. Folding case away is what lets a filename match
+    a game at all, but it also makes "RUMBLE" and "rumble" — two different games —
+    score identically against a clip named "RUMBLE clip". The casing the query
+    itself used is the only signal left to separate them.
+    """
+    if candidate and candidate in query:
+        return len(candidate)
+    return sum(1 for a, b in zip(candidate, query) if a == b)
+
+
+def _match_game_by_name(query, games, score_cutoff):
+    """Pick the local game a name refers to, preferring an exact match to a fuzzy one.
+
+    Three things this has to get right, none of which the previous inline
+    process.extractOne() call did:
+
+    * It was handed a list of (name, game) tuples as the choices, so rapidfuzz
+      scored the query against the tuple rather than the name and returned 0 for
+      everything — no local match could ever clear the cutoff, and every lookup
+      fell through to a SteamGridDB search. It also read the game back out of
+      result[2], which for a list of choices is the index, not the element.
+    * Scoring is case-insensitive, because a filename's casing rarely matches the
+      publisher's. An exact, case-sensitive hit is still taken first, so a name
+      that matches outright is never talked out of by a fuzzy score.
+    * Once case is folded away, names differing only in case tie. extractOne
+      resolves a tie by returning whichever it reached first, which is row order —
+      so which of two real games got suggested came down to which was added first.
+      Ties are broken on case instead.
+
+    Returns (game, score_out_of_100), or (None, 0) when nothing clears the cutoff.
+    """
+    from rapidfuzz import fuzz, process
+
+    stripped = (query or '').strip()
+    if not stripped or not games:
+        return None, 0
+
+    for game in games:
+        if game.name == stripped:
+            return game, 100
+
+    names = [g.name or '' for g in games]
+    scored = process.extract(
+        stripped,
+        names,
+        scorer=fuzz.token_set_ratio,
+        processor=str.lower,
+        score_cutoff=score_cutoff,
+        limit=None,
+    )
+    if not scored:
+        return None, 0
+
+    best_score = max(entry[1] for entry in scored)
+    tied = [entry for entry in scored if entry[1] == best_score]
+    best = max(tied, key=lambda entry: (_case_affinity(entry[0], stripped), entry[0]))
+    return games[best[2]], best_score
+
+
+def _pick_steamgrid_result(query, results):
+    """Choose among SteamGridDB hits, preferring an exact name match to the top hit.
+
+    The autocomplete endpoint orders by its own relevance, which does not separate
+    two games whose names differ only in case, so taking results[0] on faith is how
+    a clip of "RUMBLE" ends up labelled "rumble".
+    """
+    stripped = (query or '').strip()
+    for result in results:
+        if (result.get('name') or '') == stripped:
+            return result
+    case_variants = [r for r in results if (r.get('name') or '').lower() == stripped.lower()]
+    if case_variants:
+        # Same tie-break as the local lookup: nearest on case, rather than trusting
+        # an ordering that does not distinguish these at all.
+        return max(
+            case_variants,
+            key=lambda r: (_case_affinity(r.get('name') or '', stripped), r.get('name') or ''),
+        )
+    return results[0]
+
+
 def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, path: str = None):
     """
     Fuzzy match a video filename against existing games in database using RapidFuzz.
@@ -1180,7 +1264,6 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
     Returns:
         dict with 'game_id', 'game_name', 'steamgriddb_id', 'confidence', 'source' or None
     """
-    from rapidfuzz import fuzz, process
     from fireshare.models import GameMetadata
     import re
 
@@ -1203,16 +1286,11 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
                 # Try matching folder name against local game database
                 games = GameMetadata.query.all()
                 if games:
-                    game_choices = [(game.name, game) for game in games]
-                    result = process.extractOne(
-                        folder_name,
-                        game_choices,
-                        scorer=fuzz.token_set_ratio,
-                        score_cutoff=80  # Higher threshold for folder match
+                    matched_game, score = _match_game_by_name(
+                        folder_name, games, score_cutoff=80  # Higher threshold for folder match
                     )
 
-                    if result:
-                        matched_name, score, matched_game = result[0], result[1], result[2]
+                    if matched_game:
                         best_match = {
                             'game_id': matched_game.id,
                             'game_name': matched_game.name,
@@ -1232,7 +1310,7 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
                     try:
                         results = client.search_games(folder_name)
                         if results and len(results) > 0:
-                            top_result = results[0]
+                            top_result = _pick_steamgrid_result(folder_name, results)
                             # Use higher confidence for folder-based SteamGridDB match
                             detected = {
                                 'game_id': None,
@@ -1249,8 +1327,10 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
             else:
                 logger.debug(f"Skipping folder-based detection for upload folder: '{folder_name}'")
 
-    # Clean filename for better matching
-    clean_name = filename.lower()
+    # Clean filename for better matching. The original casing is kept: it is what
+    # tells "RUMBLE" from "rumble" further down, and the only pattern below that
+    # cares about case already asks for re.IGNORECASE.
+    clean_name = filename
     # Remove common patterns: dates, numbers, "gameplay", etc.
     clean_name = re.sub(r'\d{4}-\d{2}-\d{2}', '', clean_name)  # Remove dates like 2024-01-14
     clean_name = re.sub(r'\d{8}', '', clean_name)  # Remove YYYYMMDD format
@@ -1269,19 +1349,12 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
     if not games:
         logger.debug("No games in database to match against")
     else:
-        # Create list of (game_name, game_object) tuples for rapidfuzz
-        game_choices = [(game.name, game) for game in games]
-
-        # Use token_set_ratio - ignores word order and extra words
-        result = process.extractOne(
-            clean_name,
-            game_choices,
-            scorer=fuzz.token_set_ratio,
-            score_cutoff=65  # Minimum confidence (0-100 scale)
+        # token_set_ratio ignores word order and extra words
+        matched_game, score = _match_game_by_name(
+            clean_name, games, score_cutoff=65  # Minimum confidence (0-100 scale)
         )
 
-        if result:
-            matched_name, score, matched_game = result[0], result[1], result[2]
+        if matched_game:
             best_match = {
                 'game_id': matched_game.id,
                 'game_name': matched_game.name,
@@ -1301,8 +1374,9 @@ def detect_game_from_filename(filename: str, steamgriddb_api_key: str = None, pa
         try:
             results = client.search_games(clean_name)
             if results and len(results) > 0:
-                # Take the first result (SteamGridDB returns best matches first)
-                top_result = results[0]
+                # SteamGridDB returns best matches first, but cannot tell two names
+                # apart that differ only in case, so prefer an exact hit if there is one.
+                top_result = _pick_steamgrid_result(clean_name, results)
                 detected = {
                     'game_id': None,  # Not in our DB yet
                     'game_name': top_result.get('name'),
diff --git a/docker-compose.yml b/docker-compose.yml
index daa8725f..7cfd2693 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -16,7 +16,11 @@ services:
       # If you need to reset your username and password after the first run, you can set these variables again and restart the container, then log in with the new credentials and remove the variables again.
       - ADMIN_USERNAME=admin
       - ADMIN_PASSWORD=admin
-      - SECRET_KEY=replace_this_with_some_random_string
+      # Signs the login session and remember-me cookies. Leave this unset: a random
+      # key is generated on first start and kept in /data so it survives restarts.
+      # Only set it yourself if you run several Fireshare containers that must share
+      # sessions, and if you do, use a long random value unique to your deployment.
+      # - SECRET_KEY=
       # Optional: only allow logins from these IPs/CIDR ranges (comma separated, IPv4/IPv6). Empty or unset disables the whitelist. See docs/Security.md
       # - LOGIN_IP_WHITELIST=203.0.113.5,10.0.0.0/8
       # Number of trusted reverse-proxy hops used to determine the real client IP. The bundled nginx counts as 1; set to 2 when behind an additional reverse proxy (Traefik, NPM, Cloudflare, ...).
diff --git a/docs/EnvironmentVariables.md b/docs/EnvironmentVariables.md
index 33e96647..5ab3f9d2 100644
--- a/docs/EnvironmentVariables.md
+++ b/docs/EnvironmentVariables.md
@@ -20,14 +20,16 @@
 | `DEMO_UPLOAD_LIMIT_MB`        | Maximum upload size in MB when `DEMO_MODE` is enabled. Files over the limit are rejected before upload begins. `0` disables the limit.                                                                                   | `0`                           |
 | `DEMO_MODE_DELETE_ALL`        | Set to `true` to wipe all data, processed, video, and image directories on container startup. Only takes effect when `DEMO_MODE` is also `true`. Useful for resetting a demo instance to a clean state on every restart. | `false`                       |
 | **Security**                  |                                                                                                                                                                                                                          |                               |
-| `SECRET_KEY`                  | Flask session encryption key. If not set, a random key is generated on each restart, which invalidates all active sessions.                                                                                              | some random string or phrase  |
+| `SECRET_KEY`                  | Signs the login cookies. **You do not need to set this** — a random key is generated on first start and persisted to `/data/.secret_key`, so sessions survive restarts. Set it only when several containers must share sessions, and never to a value published anywhere. [See Docs](./Security.md#the-session-signing-key) | *(generated)*                 |
 | `ADMIN_USERNAME`              | The username for the initial administrative account.                                                                                                                                                                     | `admin`                       |
 | `ADMIN_PASSWORD`              | The password for the initial administrative account.                                                                                                                                                                     | `admin`                       |
 | `DISABLE_ADMINCREATE`         | Set to `true` to prevent automatic admin account creation on first run.                                                                                                                                                  | `false`                       |
 | `LOGIN_IP_WHITELIST`          | Comma-separated list of IP addresses and/or CIDR ranges (IPv4 and IPv6) allowed to log in, e.g. `203.0.113.5,10.0.0.0/8,2001:db8::/32`. When set, login requests from any other IP are rejected and the login page is hidden. Empty/unset disables the whitelist. The container fails to start if an entry is malformed. [See Docs](./Security.md#login-ip-whitelist) |                               |
 | `LOGIN_IP_WHITELIST_TRUSTED_PROXIES` | Number of trusted reverse-proxy hops in front of the app, used to determine the real client IP. The bundled nginx counts as one hop. Set to `2` when running behind an additional reverse proxy (Traefik, Nginx Proxy Manager, Cloudflare, ...). [See Docs](./Security.md#how-the-client-ip-is-determined) | `1`                           |
 | ~~LDAP~~                      | **Removed.** LDAP authentication is no longer supported. Fireshare refuses to start while any `LDAP_*` variable is still set — see [Users.md](./Users.md#ldap-has-been-removed).                                          |                               |
-| MFA / 2FA                     | Authenticator-app two-factor authentication requires no environment variables — enable it per account in Settings → Security. See [Security.md](./Security.md#two-factor-authentication-mfa). A persistent `SECRET_KEY` is recommended so logins survive restarts.  |                               |
+| MFA / 2FA                     | Authenticator-app two-factor authentication requires no environment variables — enable it per account in Settings → Security. See [Security.md](./Security.md#two-factor-authentication-mfa).                              |                               |
+| `CORS_ORIGINS`                | Comma-separated origins allowed to call the API from a different origin, with cookies, e.g. `https://app.example.com,http://192.168.1.50:3000`. Unset means same-origin only, which is what a normal deployment wants — set it only if the frontend is served separately. Each entry is a full origin (scheme, host, port) matched exactly; `*` is rejected. [See Docs](./Security.md#cross-origin-requests-cors_origins) | *(unset)*                     |
+| `SECURE_COOKIES`              | Set to `true` to mark the login cookies `Secure` so browsers only send them over HTTPS. Leave `false` if you reach Fireshare over plain HTTP, or logging in will silently fail. The cookies are always `HttpOnly` and `SameSite=Lax` regardless. [See Docs](./Security.md#cookie-flags-secure_cookies) | `false`                       |
 | **Transcoding**               |                                                                                                                                                                                                                          |                               |
 | `ENABLE_TRANSCODING`          | Set to `true` to enable video transcoding. See [README](./README.md#transcoding-optional) for details.                                                                                                                   | `false`                       |
 | `TRANSCODE_GPU`               | Set to `true` to use NVIDIA GPU (NVENC) for transcoding instead of CPU. Requires an NVIDIA GPU with NVENC support.                                                                                                       | `false`                       |
diff --git a/docs/Security.md b/docs/Security.md
index 9f2df99e..7b15a41c 100644
--- a/docs/Security.md
+++ b/docs/Security.md
@@ -6,6 +6,11 @@ can be used together.
 - [Login IP Whitelist](#login-ip-whitelist) — restrict which IPs may log in.
 - [Two-Factor Authentication (MFA)](#two-factor-authentication-mfa) — require a TOTP code after the password.
 
+Separate from those, [Cookies and cross-origin access](#cookies-and-cross-origin-access) covers the
+browser-facing defaults and the two variables that change them. The defaults suit a normal deployment;
+you only need that section if you serve the frontend from a different origin, or you terminate HTTPS
+and want to say so.
+
 ---
 
 ## Login IP Whitelist
@@ -148,11 +153,101 @@ with its password alone, and MFA can be set up again from Settings.
 ### Notes and limitations
 
 - **The demo account is excluded.**
-- **Set a persistent `SECRET_KEY`.** Sessions, including the short-lived state between the password and
-  code steps, are signed with it; without one, every restart invalidates all sessions. See
-  [EnvironmentVariables.md](./EnvironmentVariables.md).
+- **Sessions are signed with the instance's session key**, including the short-lived state between the
+  password and code steps. Fireshare generates and persists one for you — see
+  [The session signing key](#the-session-signing-key).
 - Codes validate with a ±30 second tolerance, so keep the server and phone clocks reasonably accurate.
 
+---
+
+## Cookies and cross-origin access
+
+Fireshare serves its own frontend, so the browser calls the API from the same origin it loaded the page
+from. The defaults assume exactly that, and **a normal deployment needs nothing here.**
+
+| Variable         | Description                                                                                                     | Default     |
+| ---------------- | --------------------------------------------------------------------------------------------------------------- | ----------- |
+| `CORS_ORIGINS`   | Comma-separated origins allowed to call the API from a *different* origin, with cookies. Unset means same-origin only. | *(unset)* |
+| `SECURE_COOKIES` | Set to `true` to mark the login cookies `Secure`, so browsers only ever send them over HTTPS.                     | `false`     |
+
+### Cross-origin requests (`CORS_ORIGINS`)
+
+Unset, the API answers no cross-origin request. This is what you want when Fireshare serves its own
+frontend: the page and the API share an origin, so nothing is cross-origin in the first place.
+
+Set it only if the frontend is served from somewhere else — a separate dev server, or a frontend hosted
+apart from the backend:
+
+```yaml
+# docker-compose.yml
+environment:
+  - CORS_ORIGINS=https://fireshare.example.com,http://192.168.1.50:3000
+```
+
+Each entry is a full origin — scheme, host, and port if it isn't the default — matched exactly:
+
+| Entry                       | Matches                                             |
+| --------------------------- | --------------------------------------------------- |
+| `https://app.example.com`   | ✅ `https://app.example.com`                         |
+|                             | ❌ `http://app.example.com` — different scheme       |
+|                             | ❌ `https://app.example.com:8443` — different port   |
+| `http://192.168.1.50:3000`  | ✅ only that host **and** port                       |
+
+No trailing slash, and no paths — `https://app.example.com/` is not an origin and matches nothing. On
+startup, an active list logs:
+
+```
+CORS enabled for: https://fireshare.example.com
+```
+
+> **`*` is rejected.** Allowing any origin while also allowing cookies means any site your users visit
+> could call the API as them, which browsers refuse to do in the literal `*` form for that exact reason.
+> A `*` entry is dropped with a warning in the logs; list the origins you actually need.
+
+### Cookie flags (`SECURE_COOKIES`)
+
+The login cookies are always `HttpOnly` (unreadable from JavaScript) and always `SameSite=Lax`, so
+another site's scripts cannot cause a browser to attach them to a background request aimed at your
+instance. (`Lax` still allows them on an ordinary top-level link click, which is what keeps shared
+links working when you are already signed in.)
+
+`Secure` is the one part left to you, because it depends on how you reach your instance. It defaults to
+off: plenty of instances are reached over plain HTTP on a LAN, and a `Secure` cookie is simply never
+sent over HTTP, so defaulting it on would leave those users unable to log in at all.
+
+**Set it to `true` if you reach Fireshare over HTTPS** — directly, or through a reverse proxy that
+terminates TLS:
+
+```yaml
+environment:
+  - SECURE_COOKIES=true
+```
+
+> **Turn this on only once HTTPS actually works.** With `SECURE_COOKIES=true` on a plain-HTTP instance,
+> the login request succeeds and the browser then discards the cookie, so you land back on the login
+> page with no error. If that happens, set it back to `false` and restart.
+
+### The session signing key
+
+Login cookies are signed with a per-instance key. You do not need to set one: Fireshare generates a
+random key on first start and saves it to `/data/.secret_key`, so it survives restarts and upgrades and
+sessions stay valid across them.
+
+Set `SECRET_KEY` yourself only if several Fireshare containers have to share sessions, in which case
+give them all the same long random value:
+
+```sh
+python3 -c "import secrets; print(secrets.token_hex(32))"
+```
+
+> **Don't paste an example value from any documentation, including this repo's.** A signing key is only
+> worth anything while it is secret to your instance — a value published anywhere is a value anyone can
+> sign a cookie with. Older compose files and README examples shipped with a placeholder filled in; if
+> yours still has one, delete the line and let Fireshare generate its own. Those published placeholders
+> are refused on startup and replaced with a generated key, which signs out existing sessions once.
+
+---
+
 ## User accounts and permissions
 
 Account creation, per-user permissions, password setup links, and the guardrails that keep an instance from losing its last administrator are documented in [Users, Permissions, and Profiles](./Users.md).
diff --git a/docs/TROUBLESHOOTING.md b/docs/TROUBLESHOOTING.md
index 9907b3c8..fbbc59d1 100644
--- a/docs/TROUBLESHOOTING.md
+++ b/docs/TROUBLESHOOTING.md
@@ -166,19 +166,20 @@ only valid within a ±30 second window.
 
 ## Sessions Expire on Every Restart
 
-If users are logged out every time the container restarts, `SECRET_KEY` is not set.
+Current versions generate a signing key on first start and persist it to `/data/.secret_key`, so
+sessions survive restarts on their own. If everyone is still logged out on every restart, that file is
+not surviving:
 
-Without `SECRET_KEY`, a random key is generated on each startup, invalidating all existing session cookies.
+- **`/data` isn't a persistent volume**, or is mounted read-only. Check the mount, then look for
+  `generated one and saved it to` in the startup logs. If instead you see `not writable — using an
+  ephemeral key`, the container cannot write to `/data`.
+- **`SECRET_KEY` is set to a different value on each start.** Either leave it unset and let Fireshare
+  manage it, or set one fixed value.
 
-**Fix:** Set a stable, random value in your environment:
-```yaml
-SECRET_KEY=some-long-random-string-here
-```
+A single sign-out after upgrading is expected if your compose file still carries the old example
+`SECRET_KEY`: that published value is refused and replaced with a generated one. Delete the line.
 
-Generate one with:
-```sh
-python3 -c "import secrets; print(secrets.token_hex(32))"
-```
+See [Security.md](./Security.md#the-session-signing-key).
 
 ---
 
diff --git a/entrypoint.sh b/entrypoint.sh
index c9452f5c..e0767ef7 100755
--- a/entrypoint.sh
+++ b/entrypoint.sh
@@ -120,10 +120,35 @@ log "Nginx ready"
 export PATH=/opt/python3.14/bin:/usr/local/bin:$PATH
 export LD_LIBRARY_PATH=/usr/local/nvidia/lib:/usr/local/nvidia/lib64:/usr/local/lib:/usr/local/cuda/lib64:${LD_LIBRARY_PATH}
 
+# Both placeholders shipped filled in — one in docker-compose.yml, one in the
+# README's compose example — so an instance that never edited the line signs its
+# login cookies with a key published in the repo. Either counts as unset.
+case "$SECRET_KEY" in
+    replace_this_with_some_random_string|replace_with_random_string_can_be_anything)
+        warn "SECRET_KEY is still an example value from the Fireshare docs — ignoring it and using a generated key instead."
+        warn "Remove that line from your compose file; a key is generated and kept in /data automatically."
+        SECRET_KEY=""
+        ;;
+esac
+
+# Kept in the data directory rather than regenerated per boot, so a restart does
+# not sign every existing session out.
+SECRET_KEY_FILE="$DATA_DIRECTORY/.secret_key"
 if [ -z "$SECRET_KEY" ]; then
-    export SECRET_KEY=$(python3 -c "import secrets; print(secrets.token_hex(32))")
-    log "SECRET_KEY not set — generated ephemeral key for this session"
+    if [ -s "$SECRET_KEY_FILE" ]; then
+        SECRET_KEY=$(cat "$SECRET_KEY_FILE")
+        log "Loaded persisted SECRET_KEY from $SECRET_KEY_FILE"
+    else
+        SECRET_KEY=$(python3 -c "import secrets; print(secrets.token_hex(32))")
+        if (umask 077 && printf '%s' "$SECRET_KEY" > "$SECRET_KEY_FILE") 2>/dev/null; then
+            chown appuser:appuser "$SECRET_KEY_FILE" 2>/dev/null || true
+            log "SECRET_KEY not set — generated one and saved it to $SECRET_KEY_FILE"
+        else
+            warn "SECRET_KEY not set and $SECRET_KEY_FILE is not writable — using an ephemeral key; sessions will not survive a restart."
+        fi
+    fi
 fi
+export SECRET_KEY
 
 # ── Database ──────────────────────────────────────────────────────────────────
 section "Database"