diff --git a/pkgs/by-name/al/alist/package.nix b/pkgs/by-name/al/alist/package.nix
index 77805b365d33..80bd8031389b 100644
--- a/pkgs/by-name/al/alist/package.nix
+++ b/pkgs/by-name/al/alist/package.nix
@@ -103,6 +103,10 @@ buildGoModule rec {
       # alist-web
       mit
     ];
+    knownVulnerabilities = [
+      "Alist was acquired by Bugotech, a company distrusted by the community"
+      "Uses a questionable API server alist.nn.ci for account creation for certain drivers"
+    ];
     maintainers = with lib.maintainers; [ moraxyc ];
     sourceProvenance = with lib.sourceTypes; [
       fromSource