• assets/js/sabr/shaka-player/controls.css: Generated file

src/invidious/routes/proxy.cr:213

• The proxied response also reflects Origin and sets Access-Control-Allow-Credentials=true. Even if preflight is tightened, this still enables credentialed cross-origin reads for any allowed upstream host. If CORS is needed at all here, avoid Allow-Credentials and only set ACAO when an Origin is present (and add Vary: Origin).
  src/invidious/routes/proxy.cr:95
• Custom headers from the __headers query param are currently accepted verbatim, but ALLOWED_HEADERS is not enforced. This allows clients to smuggle arbitrary headers upstream (e.g., Cookie, Host, X-Forwarded-*, etc.), which is a security risk even with an allowlisted host set. Filter __headers to the explicit allowlist (case-insensitive) before copying into request_headers.
  src/invidious/routes/proxy.cr:100
• This route uses puts for warning output. Invidious routes elsewhere use LOGGER, which integrates with the app’s log level/formatting. Please use LOGGER.warn here so proxy warnings are captured consistently.
  src/invidious/routes/proxy.cr:193
• For POST requests, the proxy reads the entire request body into memory via getb_to_end before forwarding. A malformed or unexpectedly large body can cause high memory usage per request. Consider streaming the request body to the upstream client (or enforcing a strict size limit / Content-Length cap) instead of buffering everything.

• assets/js/sabr/shaka-player/controls.css: Generated file

src/invidious/routes/before_all.cr:53

• The global CSP is being weakened for every response by adding both 'unsafe-eval' and 'unsafe-inline' to script-src. This substantially increases the blast radius of any XSS (inline script execution + eval) and also affects pages that never load the SABR player. Consider scoping these relaxations to SABR pages only (e.g., watch/embed when quality=sabr), or using nonces/hashes + avoiding eval where possible.
  package.json:12
• package.json dependency versions don't match package-lock.json (e.g. package.json requests googlevideo ^4.1.1 / youtubei.js ^17.2.0 / bgutils-js ^4.0.2, but the lockfile pins 4.0.4 / 17.0.1 / 3.2.0). This will produce inconsistent installs depending on whether npm honors the lockfile, and can break bundling/reproducibility. Align the versions (or regenerate the lockfile).

  "dependencies": {
    "googlevideo": "^4.1.1",
    "youtubei.js": "^17.2.0",
    "bgutils-js": "^4.0.2"
  },

src/invidious/routes/proxy.cr:220

• The proxy response sets Access-Control-Allow-Credentials: true. Removing this avoids credentialed cross-origin reads, and also avoids the invalid "" + credentials combination when Origin is missing (since this route currently falls back to "").
  src/invidious/routes/proxy.cr:59
• CORS is currently reflecting the request Origin (or using "") while also advertising Access-Control-Allow-Credentials: true. Using "" with credentials is invalid per the CORS spec, and reflecting arbitrary origins with credentials can allow other sites to read proxied responses. Since /proxy is same-origin for the SABR player, it should not need credentialed CORS at all.
  src/invidious/routes/proxy.cr:104
• This route logs parse failures with puts, which bypasses the app logger and can spam stdout in production. Use LOGGER.warn (or similar) for consistency with the rest of the routes.
  assets/js/sabr_player.js:42
• BG_HELPER_URL is hardcoded to http://127.0.0.1:4416/generate, which is the end-user's localhost (browser-side), not the Invidious server. For remote instances this will always fail, and allowing/encouraging browser JS to talk to localhost can have security implications (probing local services). Consider making this a same-origin endpoint (e.g. /bg-helper/generate) and proxying server-side, or gating this feature behind an explicit opt-in.

  // bg-helper-server /generate endpoint. Mints an ATTESTED (StreamProtectionStatus=1)
  // PO token server-side, where jsdom presents a youtube.com origin. In-browser BotGuard
  // (Invidious origin) can only get status 2 (pending), so it's used only as a fallback.
  var BG_HELPER_URL = 'http://127.0.0.1:4416/generate';

assets/js/sabr_scheme_plugin.js:308

• The SABR_REDIRECT handler assigns to currentState.sabrUrl, but the request loop uses currentState.sabrStreamState.sabrUrl. As written, the assignment has no effect and is misleading (and also contradicts the header comment claiming the redirect bug is fixed). If redirects are intentionally ignored for compatibility, remove this write entirely (or update the comments accordingly).

              // (sabrStreamState.sabrUrl). Earlier we "fixed" this to follow the redirect,
              // which pins the session to a specific CDN host (rrN---snXXX) that maintains a
              // sequential cursor and returns 0 media when the client jumps/seeks. Following
              // the redirect breaks seeking; ignoring it (as FreeTube does) keeps seeks working.
              currentState.sabrUrl = sabrRedirect.url;

scripts/fetch-sabr-dependencies.cr:5

• require "digest/sha1" is unused in this script. Keeping unused requires increases load time and can trip linting/static checks. Remove it if not needed.

require "http"
require "yaml"
require "digest/sha1"
require "option_parser"
require "colorize"