Package: miniflux Version: 2.1.4-1 The Debian package in trixie seems to run as root, which isn't ideal. I believe the upstream packages create a separate miniflux user instead.
In addition, there's some hardening options that could be lifted off the upstream systemd unit: [Service] RuntimeDirectory=miniflux AmbientCapabilities=CAP_NET_BIND_SERVICE ProtectSystem=strict PrivateTmp=yes NoNewPrivileges=yes RestrictNamespaces=yes ProtectHome=yes PrivateDevices=yes ProtectControlGroups=yes ProtectKernelModules=yes ProtectKernelTunables=yes ProtectHostname=yes RestrictRealtime=yes ProtectKernelLogs=yes ProtectClock=yes SystemCallArchitectures=native LockPersonality=yes MemoryDenyWriteExecute=yes I tested these and running with a separate user and group, and it seems to work fine. Unfortunately, DynamicUser=yes doesn't really work if you're using ident authentication (UNIX socket and no password) to connect to Postgres.
