Kavita has OPDS support, so if you need a selfhosted OPDS server to test with, that would be a good option. Would be great if the app worked well with Kavita in general too, it has a good API you could work with.

Seems trivial to me for someone to guess file paths and use those to confirm if specific content is on a jellyfin server. With how prevalent things like docker and sonarr are, filepaths are pretty standardized these days. I wouldn’t trust JF without a VPN

Then you are vulnerable to all the security holes jellyfin has left open for years

Not to mention bots/people/companies watching torrent peers, looking up SSL certs for the IPs, then attacking anything with jelly in it… Security through obscurity is not security

Cloudflare is very much involved with self hosting. Almost all of its products are related to it…