mirror of
https://github.com/Shineii86/AniKotoAPI.git
synced 2026-10-22 19:05:11 +00:00
Shinei Nouzen
30fdcd93c2
Security:
- Fixed unauthenticated SSRF in /api/stream/proxy and /api/stream/ts-proxy
- proxy allowlist had escape hatch via pathname.endsWith('.m3u8') bypass
- ts-proxy had no destination validation at all
- Both could fetch internal services (127.0.0.1, 169.254.169.254)
- Added streamProxy.helper.js with domain allowlist, private IP blocking,
and http(s)-only enforcement applied to both endpoints
- Removed dead megaplay-1.buzz; added vid-tube.site, norami.top,
kryntal.top, akirax.buzz to allowlist
- Added SECURITY.md with vulnerability reporting policy
Bug fix:
- Fixed dotenv.config() loading after static imports -- helpers reading
process.env at top level never received .env values. Changed to
import 'dotenv/config' as first import
Config:
- Added STREAM_PROXY_DOMAINS env var for custom allowlist
- Added STREAM_PROXY_REFERER env var for custom CDN Referer
2.5 KiB
2.5 KiB
Security Policy
Supported versions
| Version | Supported |
|---|---|
| 2.4.x | ✅ |
| < 2.4 | ❌ |
Fixes land on the latest release. If you are running an older version, upgrade before reporting — the issue may already be resolved.
Reporting a vulnerability
Please do not open a public issue or pull request for a security problem. Public reports expose every running instance until a fix ships.
Report privately instead:
- Preferred — GitHub private vulnerability reporting. Use the Report a vulnerability button on the Security tab. This keeps the discussion private until an advisory is published.
- Fallback — Telegram. If private reporting is unavailable, message @Shineii86 asking for a private channel. Send only a one-line description there, not the full details.
What to include
The more of this you can provide, the faster a fix can be confirmed:
- The affected endpoint or module, and the version or commit you tested.
- What an attacker can achieve — reading data, changing state, exhausting resources.
- Minimal steps to reproduce, ideally a single request.
- Whether authentication or any particular deployment setup is required.
- A suggested fix, if you have one.
What happens next
- Reports are acknowledged as soon as the maintainer sees them.
- Once confirmed, a fix is prepared privately and released, and a GitHub advisory is published crediting the reporter unless anonymity is requested.
- Reporters are asked to hold public details until the fix is released.
This project is maintained by one person as unpaid work. Please read the timing above as intent rather than a guaranteed schedule.
Scope
In scope — anything that lets someone abuse a deployed instance:
- Server-side request forgery, or any way to make the server fetch or reach destinations it should not.
- Injection, path traversal, or unsafe handling of caller-supplied input.
- Leakage of environment variables, credentials, or internal configuration.
- Denial of service reachable through a single unauthenticated request.
- Vulnerable dependencies with a practical path to exploitation in this codebase.
Out of scope:
- Availability, downtime, or changes to the upstream anime sites this API scrapes.
- Rate limiting or abuse controls on those upstream sites.
- Findings that require an already-compromised host or shell access to the server.
- Reports produced by automated scanners with no demonstrated impact.