byte-capsule/FanCode-Hls-Fetcher

Public scan — anyone with this URL can view this analysis. Sign up to track your own repos privately, run scheduled re-scans, and get AI fix prompts via your dashboard.

4 of your 28 findings came from Repobility's proprietary detections. ✓ Repobility tags below mark them.

Scan timing: clone 3.98s · analysis 8.76s · 4.1 MB · GitHub API rate-limit (preflight)

https://github.com/byte-capsule/FanCode-Hls-Fetcher · scanned 2026-06-05 23:57 UTC (4 days, 2 hours ago) · 10 languages

39 raw signals (25 security + 14 graph) 40th percentile · Python · tiny (<2K LoC) System graph score 81 (lower by 19)

File as issue Image

UNIFIED Repobility · multi-layer engine · AI coders

Complete repo analysis

Last scanned 4 days, 2 hours ago · v2 · 29 actionable findings from 2 signal sources. 3 repeated signals grouped for readability. Security checks, system graph analysis, and verified AI-agent feedback are merged into one review queue.

JSON

66.7% cov · 5 findings

Score breakdown â 2026-05-18-v5

Component	Sub-score	Weight	Contribution
`structure_score`	30.0	0.15	4.50
`security_score`	62.8	0.25	15.70
`testing_score`	70.0	0.20	14.00
`documentation_score`	60.0	0.15	9.00
`practices_score`	72.0	0.15	10.80
`code_quality`	80.0	0.10	8.00
Overall		1.00	62.0

Severity distribution — click a segment to filter

Active filters: excluding tests × Reset all

Severity: Critical 0 High 7 Medium 13 Low 7 9-Layer: Software Security Quality Integrity Frontend Hardware Data Network Cicd Source: Security checks 24 System graph 5 Crowd 0 Layer: Software 20 Security 2 Quality 3 Cicd 2 Api 1 Frontend 1

Exclude dismissed / FP Exclude test files

Scan summary Quality grade C+ (62/100). Dimensions: security 63, maintainability 30. 25 findings (18 security). 22 lines analyzed.

Showing 27 of 29 actionable findings. 32 raw detector signals were grouped into reader-sized issues. Click TP / FP to vote on a finding's accuracy — votes adjust the confidence weighting and improve detection across the platform.

high Security checks quality Quality conf 1.00 ✓ Repobility [MINED036] Python Os System Call: os.system() invokes shell with no escaping.

Review and fix per the pattern semantics. See CWE-78 / for context.

decrypt.py:21

medium Security checks cicd CI/CD security conf 0.90 ✓ Repobility 2 occurrences GitHub Action is tag-pinned rather than SHA-pinned

Action `ad-m/github-push-action` pinned to mutable ref `@v0.6.0` uses a mutable tag or branch. Pin external actions to a reviewed full commit SHA when the workflow is security-sensitive.

lines 41

.github/workflows/main.yml:41 (2 hits)

CI/CD securitySupply chainGitHub Actions

high Security checks software dependencies conf 0.88 pycryptodome: GHSA-j225-cvw7-qrx7

PyCryptodome and pycryptodomex side-channel leakage for OAEP decryption

requirements.txt

high Security checks software dependencies conf 0.88 urllib3: GHSA-2xpw-w6gg-jr37

urllib3 streaming API improperly handles highly compressed data

requirements.txt

high Security checks software dependencies conf 0.88 urllib3: GHSA-38jv-5279-wg99

Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)

requirements.txt

high Security checks software dependencies conf 0.88 urllib3: GHSA-gm62-xv2j-4w53

urllib3 allows an unbounded number of links in the decompression chain

requirements.txt

high Security checks software dependencies conf 0.88 urllib3: PYSEC-2023-212

urllib3 is a user-friendly HTTP client library for Python. urllib3 previously wouldn't remove the HTTP request body when an HTTP redirect response using status 301, 302, or 303 after the request had its method changed from one that could accept a request body (like `POST`) to `GET` as is required b…

requirements.txt

high Security checks software dependencies conf 0.88 urllib3: PYSEC-2026-141

urllib3 is an HTTP client library for Python. From 1.23 to before 2.7.0, cross-origin redirects followed from the low-level API via ProxyManager.connection_from_url().urlopen(..., assert_same_host=False) still forward these sensitive headers. This vulnerability is fixed in 2.7.0.

requirements.txt

medium Security checks security path traversal conf 1.00 [SEC012] ZipSlip — Archive Path Traversal: Archive extraction without path validation allows writing files outside the target directory.

Validate extracted paths with os.path.realpath() and ensure they stay within the target directory.

decrypt.py:6

low Security checks quality Error handling conf 0.55 ✓ Repobility Broad exception handler needs review

This handler catches Exception/BaseException. It is actionable when it swallows errors without logging, re-raising, or returning a structured error. Handlers that intentionally convert exceptions into typed error results should not be treated as high risk.

decrypt.py:9 Error handlingquality

medium Security checks software dependencies conf 0.88 diskcache: GHSA-w8v5-vhqr-4h9v

DiskCache has unsafe pickle deserialization

requirements.txt

medium Security checks software dependencies conf 0.90 Python package `cachetools` is 2 major version(s) behind (5.3.3 -> 7.1.4)

`cachetools==5.3.3` is 2 major version(s) behind the latest stable release on PyPI (7.1.4). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:8

medium Security checks software dependencies conf 0.90 Python package `pytz` is 3 major version(s) behind (2023.3.post1 -> 2026.2)

`pytz==2023.3.post1` is 3 major version(s) behind the latest stable release on PyPI (2026.2). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:2

medium Security checks software dependencies conf 0.88 pyzipper: GHSA-crqm-m339-7m2p

pyzipper has an encryption bypass for small files encrypted using it

requirements.txt

medium Security checks software dependencies conf 0.88 requests: GHSA-9hjg-9r4m-mvj7

Requests vulnerable to .netrc credentials leak via malicious URLs

requirements.txt

medium Security checks software dependencies conf 0.88 requests: GHSA-9wx4-h78v-vm56

Requests `Session` object does not verify requests after making first request with verify=False

requirements.txt

medium Security checks software dependencies conf 0.88 requests: GHSA-gc5v-m9x4-r6x2

Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility function

requirements.txt

medium Security checks software dependencies conf 0.88 urllib3: GHSA-34jh-p97f-mpxf

urllib3's Proxy-Authorization request header isn't stripped during cross-origin redirects

requirements.txt

medium Security checks software dependencies conf 0.88 urllib3: GHSA-pq67-6m6q-mj2v

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

requirements.txt

medium System graph security Coverage conf 1.00 No auth library detected

The scanner did not find any standard auth library (JWT, OAuth, NextAuth, Auth0, etc.). Either auth lives in custom code, in a separate service, or is missing.

auth

medium System graph quality Tests conf 1.00 Very low test-to-source ratio

0 test file(s) for 1 source file(s) (ratio 0.00). Consider adding integration or unit tests for critical paths.

Coverage

low Security checks software dependencies conf 0.90 Python package `beautifulsoup4` is minor version(s) behind (4.12.3 -> 4.14.3)

`beautifulsoup4==4.12.3` is minor version(s) behind the latest stable release on PyPI (4.14.3). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:7

low Security checks software dependencies conf 0.90 Python package `pycryptodome` is minor version(s) behind (3.19.0 -> 3.23.0)

`pycryptodome==3.19.0` is minor version(s) behind the latest stable release on PyPI (3.23.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:1

low Security checks software dependencies conf 0.90 Python package `pyzipper` is minor version(s) behind (0.3.6 -> 0.4.0)

`pyzipper==0.3.6` is minor version(s) behind the latest stable release on PyPI (0.4.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:5

low Security checks software dependencies conf 0.90 Python package `requests` is minor version(s) behind (2.31.0 -> 2.34.2)

`requests==2.31.0` is minor version(s) behind the latest stable release on PyPI (2.34.2). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:3

low Security checks software dependencies conf 0.90 Python package `urllib3` is minor version(s) behind (2.0.6 -> 2.7.0)

`urllib3==2.0.6` is minor version(s) behind the latest stable release on PyPI (2.7.0). Pinned-but-stale Python dependencies drift away from upstream security and bugfix releases. This is the version-currency signal Dependabot raises.

requirements.txt:4

low System graph cicd CI/CD security conf 1.00 3 occurrences GitHub Action is tag-pinned rather than SHA-pinned

actions/checkout@v2 can move without a code change in this repo. Pin third-party actions to a reviewed 40-character commit SHA.

lines 13, 16

.github/workflows/main.yml:13, 16 (3 hits)

CI/CD securitySupply chainGitHub Actions

For AI agents: Voting guide (TP/FP) MCP manifest Stdio wrapper SARIF Integrate Findings queue Vote TP/FP on findings to calibrate the engine.

For AI agents + API integrations

Email me when this repo regresses

Free. We re-scan periodically; new criticals → your inbox. No signup required for the scan itself.

API access

This page is publicly accessible at: https://repobility.com/scan/6e970c47-47fd-4753-8c95-fd218620b1e3/

To check status programmatically (no auth required):

curl -s https://repobility.com/api/v1/public/scan/6e970c47-47fd-4753-8c95-fd218620b1e3/

Important — please don't re-submit the same URL repeatedly. The submission endpoint is idempotent: re-submitting the same git URL returns this same scan_token, not a new one. To re-scan this repo, sign up free and use the dashboard.