> For the complete documentation index, see [llms.txt](https://wiki.crosswatch.app/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.crosswatch.app/getting-started/support-matrix/operations-and-limits.md). # Operations and limits This section covers security behavior, storage layout, runtime notes, and the main repository areas behind each system. {% hint style="info" %} Use this page when you need exact paths, security behavior, or implementation map pointers. {% endhint %} ### At a glance {% columns %} {% column %} #### Covers * secret storage and config safety * state and backup paths * runtime logging and telemetry {% endcolumn %} {% column %} #### Also includes * key product limits * source-map pointers into the repo * related docs for deeper details {% endcolumn %} {% endcolumns %} ### Jump to related docs
TitleOpen
Safe defaults and operating guidance/spaces/3rh5THg1PdhVsBt3GALo/pages/aXxgMcv8AubC0CypFUTO
Size and provider fit guidance/spaces/3rh5THg1PdhVsBt3GALo/pages/Lws31PpVM04pXySTwH8d
Config file reference/spaces/3rh5THg1PdhVsBt3GALo/pages/wSx6U3V0FNJ3e2pvDywh
Provider pacing and retries/spaces/3rh5THg1PdhVsBt3GALo/pages/uIdojSHyuBmDdMI0yPFg
### Security and configuration | Capability | Supported | Notes | | --------------------------------- | --------: | --------------------------------------------------------------------- | | Encrypted stored secrets | Yes | Fernet encryption | | Generated local master key | Yes | Stored as `.cw_master_key` with restrictive permissions when possible | | External master key | Yes | `CW_CONFIG_KEY` or `CROSSWATCH_CONFIG_KEY` | | Secret redaction | Yes | Tokens, API keys, passwords, session IDs, and webhook identifiers | | Optional local UI login | Yes | Username and password | | Password hashing | Yes | PBKDF2 SHA256, 260000 iterations | | Remember session | Yes | Configurable duration | | Multiple login sessions | Yes | | | HTTP interface | Yes | | | HTTPS interface | Yes | | | Automatic self-signed certificate | Yes | Configurable hostname and validity | | Custom certificate and key | Yes | | | Provider SSL verification | Yes | Configurable for local server providers | | Atomic configuration writes | Yes | Temporary file replacement | | Configuration backup before reset | Yes | | | Backup path validation | Yes | Restricts access to managed backup paths | | Capture path validation | Yes | Restricts access to managed capture paths | ### Runtime and storage | Area | Default or support | | ----------------------------- | -------------------------------- | | Persistent configuration root | `/config` in the container image | | Main configuration | `/config/config.json` | | Main sync state | `/config/state.json` | | Manual policy state | `/config/state.manual.json` | | Provider runtime state | `/config/.cw_state` | | Local CrossWatch tracker | `/config/.cw_provider` | | Local tracker snapshots | `/config/.cw_provider/snapshots` | | Captures | `/config/snapshots` | | Backups | `/config/backups` | | Sync reports | `/config/sync_reports` | | Runtime debug logging | Supported | | HTTP access logging | Supported | | Sync module debug logging | Supported | | Provider request rate limits | Supported | | Provider retry budgets | Supported | | Usage telemetry | Enabled by default, configurable | ### Important limitations {% hint style="warning" %} Destructive removals stay off by default for a reason. Test first with dry runs. {% endhint %} 1. There is no general playlist sync feature. 2. Jellyfin and Emby ratings are not currently exposed as sync features. 3. Jellyfin and Emby watchlists are emulated through Favorites, Playlist, or Collections. 4. Jellyfin and Emby Playlist watchlist mode is episode-oriented and cannot represent shows. 5. Tautulli is a read-only history source. 6. AniList only supports anime watchlist and ratings workflows. 7. TMDb only supports watchlist and ratings sync. 8. Trakt, SIMKL, and MDBList do not participate in normal pair-based progress sync, even though they are supported by the Playback Progress Manager. 9. PublicMetaDB writes require TMDb identity, and progress writes require duration. 10. Plex progress removal may be limited by Plex behavior. 11. Destructive removals are globally disabled by default, but a pair can explicitly enable them. 12. Mirror delete mode is destructive and should be used only when the source must be authoritative. 13. Drop guard and mass-deletion settings should be configured deliberately, especially during the first sync. 14. Plex fallback GUID searching increases runtime and resource use and is intended as a temporary recovery option. 15. Provider APIs, account permissions, rate limits, and upstream behavior can still prevent an operation that the CrossWatch adapter implements. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://wiki.crosswatch.app/getting-started/support-matrix/operations-and-limits.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.