Hey all,
I was looking for a Youtube downloader to self-host, and when I found one that looked really great, it was no longer functional. So, I vibe-coded a new one.
Hermes is a front end app and a REST API for yt-dlp.
This is fully functional but I just got it on Github so give me a few days to publish images. But, feel free to clone it down now and build it yourself!
Also since you complained no one looked at your code, you have support for plain text passwords in your code. That’s a huge no no.
Thanks for looking. Make a pr.
Why the fuck would I when your this hostile?
https://github.com/TechSquidTV/Hermes/blob/main/packages/hermes-api/app/core/security.py
Well I think you lied. Only password hashes are stored and verified using bcrypt. I want to see the issue you claim to have found. So, where did you see this security issue you claim I have a responsibility to fix?
Here’s the test that proves user’s are registered with a hash. https://github.com/TechSquidTV/Hermes/blob/ff1abe653a8af66073a566d4b2c6d1910f25dae1/packages/hermes-api/tests/conftest.py#L87
the user model in the database doesn’t even have a password field: https://github.com/TechSquidTV/Hermes/blob/ff1abe653a8af66073a566d4b2c6d1910f25dae1/packages/hermes-api/app/db/models.py#L295
So please, what am I missing?