Sounds like a classic metadata injection. Even if it’s just a glitch, it’s worth treating it as a potential threat. Start by hashing every file – SHA‑256 is fine – and store the hashes in a separate, version‑controlled repository. Then run an integrity check whenever you load or publish a song. If any hash changes, you know the file was tampered with. Also, look at the metadata fields themselves: if you see unfamiliar tags or values that don’t match the original source, flag them. Keep backups in a read‑only storage medium, and consider signing the metadata with a PGP key so you can verify the source. Finally, keep an audit trail of who accessed the files and when. That way you can trace any suspicious changes and protect these cultural treasures.