akiralereal/iptv

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

13 of your 37 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 7.15s · analysis 3.49s · 5.1 MB · GitHub API rate-limit (preflight)

https://github.com/akiralereal/iptv · scanned 2026-06-05 15:03 UTC (5 days, 1 hour ago) · 10 languages

82 raw signals (34 security + 48 graph) 26th percentile · Javascript · small (2-20K LoC) System graph score 82 (lower by 28)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 5 days, 1 hour ago · v2 · 45 actionable findings from 2 signal sources. 13 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

88.9% cov · 20 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	75.0	0.15	11.25
`security_score`	49.4	0.25	12.35
`testing_score`	0.0	0.20	0.00
`documentation_score`	69.0	0.15	10.35
`practices_score`	77.0	0.15	11.55
`code_quality`	80.0	0.10	8.00
Overall		1.00	53.5

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 2 High 7 Medium 12 Low 14 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 25 System graph 20 Crowd 0 Layer: Software 9 Cicd 8 Quality 11 Security 3 Api 1 Frontend 10 Hardware 3

Exclude dismissed / FP Exclude test files

Corpus Intelligence Cross-corpus context (cohort percentile, top patterns, fix plan) is shown only on repositories you own. Sign up and connect your repo to view it.

Scan summary Ranks in the 79th percentile among tiny-sized repos. Strongest security (90), dependencies (90); weakest testing (15), structure (50). 1 findings (1 high). Most common pattern: repo-zero-tests.

Showing 35 of 45 actionable findings. 58 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

critical Security checks software dependencies conf 0.88 basic-ftp: GHSA-5rq4-664w-9x2c

Basic FTP has Path Traversal Vulnerability in its downloadToDir() method

package-lock.json

critical Security checks security secrets conf 0.95 2 occurrences Detected a Generic API Key, potentially exposing access to various services and sensitive operations.

Gitleaks detected a committed secret or credential pattern.

lines 3, 6

utils/EncryUtils.js:3, 6 (2 hits)

high Security checks software dependencies conf 0.88 basic-ftp: GHSA-6v7q-wjvx-w8wg

basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Execution via Credentials and MKD Commands

package-lock.json

high Security checks software dependencies conf 0.88 basic-ftp: GHSA-rp42-5vxx-qpwr

basic-ftp vulnerable to denial of service via unbounded memory consumption in Client.list()

package-lock.json

high Security checks software dependencies conf 0.88 basic-ftp: GHSA-rpmf-866q-6p89

basic-ftp allows a malicious FTP server to cause client-side denial of service via unbounded multiline control response buffering

package-lock.json

high Security checks software dependencies conf 0.90 ✓ Repobility Dockerfile FROM `node:22-alpine` not pinned by digest

`FROM node:22-alpine` resolves the tag at build time. The registry CAN re-push a different image for the same tag, so every build is potentially different. Production images should pin to `image@sha256:...` for reproducibility + supply-chain integrity.

Dockerfile:1

low Security checks cicd CI/CD security conf 0.90 ✓ Repobility 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `actions/checkout` pinned to mutable ref `@v6` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

lines 12

.github/workflows/push_docker.yaml:12 (2 hits)

CI/CD securitySupply chainGitHub Actions

medium Security checks quality Error handling conf 1.00 [ERR002] Empty Catch Block: Empty catch blocks hide errors.

Log the error or rethrow it. Use console.error() at minimum.

utils/refreshToken.js:63

medium Security checks quality Quality conf 1.00 [SEC087] JS: weak Math.random for crypto: Math.random() is not cryptographically secure; using it for tokens/keys/nonces is predictable. Ported from gosec G404 / eslint detect-pseudoRandomBytes concept (Apache-2.0).

Use `crypto.randomBytes(32).toString('hex')` (Node) or `crypto.getRandomValues()` (browser).

utils/androidURL.js:163

medium Security checks cicd CI/CD security conf 0.94 Compose service `iptv` image uses the latest tag

The latest tag is mutable and can change without a code review, producing different images from the same source.

docker-compose.yml:1 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.82 Docker final stage has no non-root USER

Docker images run as root unless the image or Dockerfile switches to a non-root user.

Dockerfile:1 CI/CD securitycontainers

medium Security checks cicd CI/CD security conf 0.76 Dockerfile copies broad context with incomplete .dockerignore

COPY . or ADD . is safer when .dockerignore excludes secrets, git history, keys, and generated artifacts.

Dockerfile:21 CI/CD securitycontainers

medium Security checks software dependencies conf 0.88 ip-address: GHSA-v2v4-37r5-5v8g

ip-address has XSS in Address6 HTML-emitting methods

package-lock.json

medium Security checks software dependencies conf 0.88 ws: GHSA-58qx-3vcg-4xpx

ws: Uninitialized memory disclosure

package-lock.json

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — fetchURLByAndroid720p.js:50

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph quality Integrity conf 1.00 `fetch()` without try/.catch or AbortSignal — utils/zbpro.js:48

Bare `fetch(...)` will throw an unhandled rejection on network failure. Wrap in try/catch, attach a `.catch(...)`, or pass an AbortSignal with a timeout.

runtime safetyRobustness

medium System graph hardware Security conf 1.00 Dockerfile runs as root: Dockerfile

No non-root USER set. Containers running as root expand the blast radius of any vulnerability inside the image.

Container

medium System graph cicd CI/CD security conf 1.00 4 occurrences GitHub Action is tag-pinned rather than SHA-pinned

docker/login-action@v4 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

lines 14, 19, 22, 26

.github/workflows/push_docker.yaml:14, 19, 22, 26 (4 hits)

CI/CD securitySupply chainGithub actions

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.

auth

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

0 test file(s) for 26 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.

Coverage

low Security checks cicd CI/CD security conf 0.72 .dockerignore misses sensitive defaults

.dockerignore exists but does not cover common secret or VCS patterns.

.dockerignore CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.56 Compose service does not declare a runtime user

If the image does not define USER internally, this service may run as root.

docker-compose.yml:1 CI/CD securitycontainers

high Security checks cicd CI/CD security conf 0.62 Compose service lacks no-new-privileges hardening

no-new-privileges prevents processes from gaining additional privileges through setuid binaries or file capabilities.

docker-compose.yml:1 CI/CD securitycontainers

low System graph hardware Coverage conf 1.00 Containers defined but no K8s/orchestration manifest found

Repo has Dockerfiles/compose but no Kubernetes/Nomad manifests. If the target deployment is K8s, the manifests may live in a separate ops repo.

Deployment

low System graph hardware Supply chain conf 1.00 Docker base image is tag-pinned but not digest-pinned: node:22-alpine

Container tags can be retagged upstream. Pin production base images to a reviewed digest (`image@sha256:...`) when reproducibility and supply-chain integrity matter.

Dockerfile:1 containersPinned dependencies

low System graph software Dead code candidate conf 1.00 File has no detected symbols: utils/datas.js

Source file with no class/function declarations — possible config, dead code, or scratch file.

low System graph frontend Frontend quality conf 1.00 Stray `console.log` in TS/JS — app.js:448