[sh1pt-actions-fleet]

Adds OpenProfile URL prefill to contact settings and imports connected CoinPay OpenProfile details into blank fields.

[github-actions]

ThreatCrush Security Scan

109 finding(s)

HIGH/CRITICAL: 11 | MEDIUM: 30 | LOW: 68

Severity	Rule	Location
HIGH	secret-private-key	src/app/settings/seedbox-section.tsx:412
HIGH	secret-generic-api-key	docs/incidents/2026-05-okshanaby-supply-chain.md:18
HIGH	tls-verification-disabled	src/app/api/iptv-proxy/route.ts:39
HIGH	tls-verification-disabled	src/app/api/iptv/channels/route.ts:35
HIGH	tls-verification-disabled	src/app/api/iptv/playlists/[id]/route.ts:73
HIGH	tls-verification-disabled	src/app/api/iptv/playlists/route.ts:64
HIGH	js-cors-origin-reflected	src/app/api/public/shares/[slug]/checkout/route.ts:41
HIGH	js-cors-origin-reflected	src/app/api/public/vod/[slug]/checkout/route.ts:35
HIGH	tls-verification-disabled	src/lib/iptv/shares/upstream.ts:37
HIGH	tls-verification-disabled	workers/iptv-cache/epg-fetcher.ts:25
HIGH	tls-verification-disabled	workers/iptv-cache/playlist-fetcher.ts:62
MEDIUM	secret-jwt	.github/workflows/ci.yml:120
MEDIUM	secret-jwt	.github/workflows/ci.yml:121
MEDIUM	secret-jwt	.github/workflows/ci.yml:123
MEDIUM	secret-jwt	.github/workflows/ci.yml:162
MEDIUM	secret-jwt	.github/workflows/ci.yml:164
MEDIUM	secret-jwt	docs/tunein (2).py:9
MEDIUM	secret-jwt	docs/tunein.py:9
MEDIUM	sh-remote-script-execution	scripts/setup-server.sh:182
MEDIUM	sh-remote-script-execution	scripts/setup-server.sh:419
MEDIUM	sh-remote-script-execution	scripts/setup-server.sh:428
MEDIUM	sh-unquoted-expansion-destructive	scripts/setup-server.sh:1096
MEDIUM	sh-unquoted-expansion-destructive	scripts/setup-server.sh:1106
MEDIUM	js-unescaped-html-sink	src/app/api/player/route.ts:127
MEDIUM	js-unescaped-html-sink	src/app/api/player/route.ts:281
MEDIUM	js-unescaped-html-sink	src/app/blog/[slug]/page.tsx:40
MEDIUM	js-unescaped-html-sink	src/app/blog/[slug]/page.tsx:66
MEDIUM	js-unescaped-html-sink	src/app/email/email-content.tsx:566
MEDIUM	js-open-redirect	src/app/login/page.tsx:85
MEDIUM	js-open-redirect	src/app/pricing/page.tsx:148
MEDIUM	js-open-redirect	src/app/rent/[slug]/rent-client.tsx:170
MEDIUM	js-unescaped-html-sink	src/app/rss/rss-content.tsx:615
MEDIUM	js-open-redirect	src/app/vod/[slug]/vod-client.tsx:138
MEDIUM	js-open-redirect	src/app/watch/[slug]/watch-client.tsx:131
MEDIUM	js-unescaped-html-sink	src/app/youtube/youtube-content.tsx:546
MEDIUM	js-open-redirect	src/components/account/iptv-subscription-section.tsx:121
MEDIUM	js-open-redirect	src/components/account/iptv-subscription-section.tsx:151
MEDIUM	js-unescaped-html-sink	src/components/layout/pit-footer.tsx:25
MEDIUM	js-unescaped-html-sink	src/components/news/news-section.tsx:358
MEDIUM	js-unescaped-html-sink	src/components/news/news-section.tsx:731
MEDIUM	redos-nested-quantifier	src/lib/metadata-enrichment/metadata-enrichment.ts:317
LOW	tls-verification-disabled	docs/tunein (2).py:34
LOW	tls-verification-disabled	docs/tunein (2).py:37
LOW	tls-verification-disabled	docs/tunein (2).py:47
LOW	tls-verification-disabled	docs/tunein.py:34
LOW	tls-verification-disabled	docs/tunein.py:37
LOW	tls-verification-disabled	docs/tunein.py:47
LOW	tls-verification-disabled	src/app/api/iptv-proxy/route.test.ts:457
LOW	secret-generic-credential	src/app/api/iptv/subscription/route.test.ts:66
LOW	secret-generic-credential	src/lib/argontv/client.test.ts:60

…and 59 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	@​profullstack/​profile@​0.1.6 ⏵ 0.1.7	+9		+1	+4

View full report

[socket-security]

Warning

Review the following alerts detected in dependencies.

According to your organization's Security Policy, it is recommended to resolve "Warn" alerts. Learn more about Socket for GitHub.

Priority	Alert  (click "▶" to expand/collapse)	Action
	Low adoption: npm @profullstack/openprofile Location: Package overview From: pnpm-lock.yaml → npm/@profullstack/profile@0.1.7 → npm/@profullstack/openprofile@0.2.0 ℹ Read more on: This package | This alert | What are unpopular packages? Next steps: Take a moment to review the security alert above. Review the linked package source code to understand the potential risk. Ensure the package is not malicious before proceeding. If you're unsure how to proceed, reach out to your security team or ask the Socket team for help at support@socket.dev. Suggestion: Unpopular packages may have less maintenance and contain other problems. Mark the package as acceptable risk. To ignore this alert only in this pull request, reply with the comment @SocketSecurity ignore npm/@profullstack/openprofile@0.2.0. You can also ignore all packages with @SocketSecurity ignore-all. To ignore an alert for all future pull requests, use Socket's Dashboard to change the triage state of this alert.	Warn

View full report