Rargb included a .exe which if you changed to .txt was just a message saying don’t reupload. It was to prevent indexers or something with basic “don’t download .exe” rules. So that is probably why it is not fail by default in Sonarr for everyone? I don’t know for sure but it is something.

Here is some advice then: Don’t run a public service until you understand the risks and are capable of protecting yourself and your users. It isn’t as simple as booting up a service for self use. By using Discord they minimised damages to users it would be worse if they lost control of a Discord alternative with RCE exploits.

Self hosting and providing a public service are two very different things.