Security:
- Fixed unauthenticated SSRF in /api/stream/proxy and /api/stream/ts-proxy
- proxy allowlist had escape hatch via pathname.endsWith('.m3u8') bypass
- ts-proxy had no destination validation at all
- Both could fetch internal services (127.0.0.1, 169.254.169.254)
- Added streamProxy.helper.js with domain allowlist, private IP blocking,
and http(s)-only enforcement applied to both endpoints
- Removed dead megaplay-1.buzz; added vid-tube.site, norami.top,
kryntal.top, akirax.buzz to allowlist
- Added SECURITY.md with vulnerability reporting policy
Bug fix:
- Fixed dotenv.config() loading after static imports -- helpers reading
process.env at top level never received .env values. Changed to
import 'dotenv/config' as first import
Config:
- Added STREAM_PROXY_DOMAINS env var for custom allowlist
- Added STREAM_PROXY_REFERER env var for custom CDN Referer
Major Changes:
- Add shared parseListItem.helper.js for unified list parsing (DRY)
- Migrate all 22 extractors to use fetchWithMirror() for consistent mirror fallback
- Remove unused cors dependency (custom CORS middleware handles it)
- Fix middleware ordering: timeout now registered before routes
- Fix CORS to allow POST for /api/mirrors/reset endpoint
- Remove redundant cache check in homeInfo extractor
New Features:
- Request ID tracking (X-Request-Id header) for debugging
- Graceful shutdown handling (SIGTERM/SIGINT) with 10s timeout
- CSP and HSTS security headers
- Rate limiter cleanup interval (every 5 min) to prevent memory leak
- Request body size limits (10kb) via express.json()
Security:
- Content-Security-Policy header for XSS protection
- Strict-Transport-Security for HTTPS enforcement
- X-Permitted-Cross-Domain-Policies: none
- Body size limits to prevent large payload attacks
Code Quality:
- All files follow strict documentation style (box headers, section separators,
feature markers, JSDoc params/returns, inline notes, module footers)
- Eliminated ~200 lines of duplicated code across 8+ extractors
- Updated CHANGELOG.md with comprehensive change history
Browser blocks cross-origin requests from AniKotoWeb because
Access-Control-Allow-Origin was never set when ALLOWED_ORIGINS
was undefined on Vercel. Changed condition to allow all origins
when env var is not configured.
- Changed publicDir to use process.cwd() for Vercel compatibility
- Simplified vercel.json routes: API -> server.js, everything else -> server.js
- Express.static will serve files from public/ directory
- Box-style header comments (Project, Author, License) on every file
- Section headers using double-line box decorators
- Feature markers (// ---- FEATURE: XYZ ----) before every major function
- JSDoc comments for EVERY function with @param, @returns, @example
- Inline notes (NOTE, WARNING, TIP) for non-obvious logic
- Footer END markers on every module
- Matched code style to AlisaReactionBot repository
- All files now searchable by feature name via grep
Author: Shinei Nouzen <157171073+Shineii86@users.noreply.github.com>
- Express.js server with Vercel deployment support
- Complete API endpoints for anikototv.to anime data
- Home, search, info, episodes, stream, schedule endpoints
- Category filtering and genre support
- Caching system with 5-minute TTL
- CORS configuration
- Public documentation page
- Docker and Render deployment configs
- MIT License
Shinei Nouzen