rajput-hemant/infinitunes

36 findings

33 medium3 low

• Mediumlow confidenceServer Action getPlaylistDetails (src/lib/db/queries.ts) has no validator or rate limiter attached.

  Server Action getPlaylistDetails (src/lib/db/queries.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/db/queries.ts:21

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getPlaylistDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action addSongsToPlaylist (src/lib/db/queries.ts) has no validator or rate limiter attached.

  Server Action addSongsToPlaylist (src/lib/db/queries.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/db/queries.ts:29

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function addSongsToPlaylist(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getHomeData (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getHomeData (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:73

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getHomeData(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getSongDetails (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getSongDetails (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:90

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getSongDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getSongRecommendations (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getSongRecommendations (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:106

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getSongRecommendations(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getAlbumDetails (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getAlbumDetails (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:129

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getAlbumDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getAlbumRecommendations (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getAlbumRecommendations (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:144

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getAlbumRecommendations(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getAlbumFromSameYear (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getAlbumFromSameYear (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:164

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getAlbumFromSameYear(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getPlaylistDetails (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getPlaylistDetails (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:187

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getPlaylistDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getPlaylistRecommendations (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getPlaylistRecommendations (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:202

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getPlaylistRecommendations(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getArtistDetails (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getArtistDetails (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:225

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getArtistDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getArtistsSongs (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getArtistsSongs (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:243

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getArtistsSongs(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getArtistsAlbums (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getArtistsAlbums (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:271

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getArtistsAlbums(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getArtistTopSongs (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getArtistTopSongs (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:301

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getArtistTopSongs(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getShowDetails (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getShowDetails (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:333

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getShowDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getShowEpisodes (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getShowEpisodes (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:353

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getShowEpisodes(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getEpisodeDetails (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getEpisodeDetails (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:374

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getEpisodeDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getTopSearches (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getTopSearches (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:394

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getTopSearches(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action searchAll (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action searchAll (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:403

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function searchAll(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action search (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action search (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:415

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function search(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getTrending (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getTrending (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:443

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getTrending(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getTopAlbums (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getTopAlbums (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:463

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getTopAlbums(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getCharts (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getCharts (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:480

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getCharts(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getFeaturedPlaylists (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getFeaturedPlaylists (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:497

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getFeaturedPlaylists(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getTopArtists (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getTopArtists (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:519

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getTopArtists(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getTopShows (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getTopShows (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:540

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getTopShows(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getFeaturedRadioStations (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getFeaturedRadioStations (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:557

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getFeaturedRadioStations(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getActorsTopSongs (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getActorsTopSongs (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:579

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getActorsTopSongs(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getLyrics (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getLyrics (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:598

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getLyrics(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getLabelDetails (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getLabelDetails (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:614

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getLabelDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getMixDetails (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getMixDetails (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:645

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getMixDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getMegaMenu (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getMegaMenu (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:667

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getMegaMenu(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Mediumlow confidenceServer Action getFooterDetails (src/lib/jiosaavn-api.ts) has no validator or rate limiter attached.

  Server Action getFooterDetails (src/lib/jiosaavn-api.ts) is a public POST endpoint: it accepts whatever arguments a caller sends, as often as they send them.

  Where

  src/lib/jiosaavn-api.ts:679

  Missing

  Schema validation of the action's arguments, and a rate limit.

  Confidence

  Inline validation (zod.parse on the form data) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  const Input = z.object({ title: z.string().min(1).max(200) });
  
  export async function getFooterDetails(formData: FormData) {
    const parsed = Input.safeParse(Object.fromEntries(formData));
    if (!parsed.success) return { error: parsed.error.flatten() };
    // ...use parsed.data, never formData directly
  }

  Intended? If validation and rate limiting happen upstream (Vercel Firewall, a middleware), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

• Lowhigh confidenceaccount is not connected to anything.

  account is connected to nothing: dead weight, or a route that was meant to use it and does not.

  Missing

  A route that uses it, or its removal.

  Confidence

  Nothing is wired to it in the design.

  Intended? If it is used by a job or another service, accept it as known debt: run wyro-check --update-baseline and commit the ledger. It stays visible and CI fails only on new findings.

  no-orphan-datastore

• Lowhigh confidenceverificationToken is not connected to anything.

  verificationToken is connected to nothing: dead weight, or a route that was meant to use it and does not.

  Missing

  A route that uses it, or its removal.

  Confidence

  Nothing is wired to it in the design.

  Intended? If it is used by a job or another service, accept it as known debt: run wyro-check --update-baseline and commit the ledger. It stays visible and CI fails only on new findings.

  no-orphan-datastore

• Lowlow confidenceGET /api/og has no validator or rate limiter attached.

  GET /api/og can be called at any rate. Cheap to fix, rarely urgent on a read.

  Where

  src/app/api/og/route.tsx:27

  Missing

  A rate limit.

  Confidence

  Inline validation (zod.parse, pydantic models) and platform rate limits are not always visible to the parser. Check before acting.

  Fix

  // 60 requests per IP per minute.
  app.get("/api/og", rateLimit({ windowMs: 60_000, limit: 60 }), handler);

  Intended? If validation and rate limiting happen upstream (an API gateway, Vercel Firewall), turn the rule off for the repo: { "policy": { "rules": { "public-entry-guarded": "off" } } } in wyro.json.

  public-entry-guarded

Free account, no card. The repository opens as an editable graph.