[ AutoFiC ] Security Patch 2025-07-31

index.js

@@ -1,5 +1,7 @@
 import express from "express";
 import cors from "cors";
+import helmet from "helmet"; // Added helmet import
+import rateLimit from "express-rate-limit"; // Added rate-limit import
 import { fileURLToPath } from "url";
 import { dirname, join, basename } from "path";
 import { createRequire } from "module";
@@ -29,8 +31,15 @@ let isRunning = !1,
   server = null;
 async function start(file) {
   const app = express();
-  app.use(cors())
-    const port = process.env.PORT || process.env.SERVER_PORT || 3e3,
+  app.use(cors());
+  app.use(helmet()); // Disable X-Powered-By header
+  const limiter = rateLimit({
+    windowMs: 15 * 60 * 1000, // 15 minutes
+    max: 100, // Limit each IP to 100 requests per windowMs
+  });
+  app.use(limiter); // Apply rate limiting to all requests
+
+  const port = process.env.PORT || process.env.SERVER_PORT || 3e3,
     htmlDir = join(__dirname, "html"),
     sendHtml = (req, res, name) => res.sendFile(join(htmlDir, `${name}.html`));
   if (

lib/ai/exh-api.js

@@ -2,7 +2,7 @@ import fetch from "node-fetch";
 import crypto from "crypto";
 class ExhApiClient {
   constructor(
-    apiKey = "eyJhbGciOiJIUzUxMiJ9.eyJ1c2VybmFtZSI6ImJvdGlmeS13ZWItdjMifQ.O-w89I5aX2OE_i4k6jdHZJEDWECSUfOb1lr9UdVH4oTPMkFGUNm9BNzoQjcXOu8NEiIXq64-481hnenHdUrXfg",
+    apiKey = process.env.EXH_API_KEY,
   ) {
     (this.DEFAULT_API_KEY = apiKey),
       (this.BASE_URL = "https://api.exh.ai"),

lib/ai/fineshare.js

@@ -6,8 +6,7 @@ import chalk from "chalk";
 import ora from "ora";
 class FineShare {
   spinner;
-  token =
-    "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJ1c2VySWQiOiI5MGZlNzllYS0yODExLTRiMjctYWU0ZS1hZGMzNGFhZDM2NzMiLCJ1c2VyQWNjb3VudCI6InZvaWNlQGZpbmVzaGFyZS5jb20ifQ.AO9q9TKXZ79G6oH70YX5ypOGuSBcLP7K4wEDGIzrDDw";
+  token = process.env.FINESHARE_API_TOKEN; // Use an environment variable for the token
   constructor() {
     this.spinner = ora({
       text: "FineShare",

lib/ai/remaker.js

@@ -3,7 +3,7 @@ import { fileTypeFromBuffer } from "file-type";
 import fetch from "node-fetch";
 class RemakerAi {
   constructor(
-    token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpZCI6MTMwOTY4MjMsInByb2R1Y3RfY29kZSI6IjA2NzAwMyIsInRpbWUiOjE3MjU3OTc3ODl9.JCa-FpsS9dEpZj5g0kg-gcIHID1b_Vig71cThP0Xm4M",
+    token = process.env.REMAKER_AI_TOKEN,
   ) {
     this.headers = {
       Authorization: token,

lib/ai/rushchat.js

@@ -4,7 +4,7 @@ class RushChat {
     this.apiUrl = "https://rushchat.ai/api/rush/chat/v1";
     this.token =
       token ||
-      "eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJsb2dpblR5cGUiOiJsb2dpbiIsImxvZ2luSWQiOjE4MzUzMDI5MDcxNDQ2MzQzNzAsInJuU3RyIjoiWmxYbDZhdDJhMnB6d2dLQVBCamY1T0dSb0VDR0xWY0QifQ.1HzKHmTcdkvhMtuykuJ03_VNsePnXwQ_n-JBYA-T_tY";
+      process.env.RUSHCHAT_API_TOKEN; // Use an environment variable to store the token securely
     this.userAgent =
       "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Mobile Safari/537.36";
   }

lib/download/social-dl.js

@@ -18,8 +18,8 @@ export const socialDl = async (url) => {
       {
         headers: {
           "Content-Type": "application/json",
-          token: "eyJ0eXAiOiJqd3QiLCJhbGciOiJIUzI1NiJ9.eyJxxx",
-          apikey: "manhdeptraicogisai",
+          token: process.env.API_TOKEN, // Use environment variable
+          apikey: process.env.API_KEY,  // Use environment variable
         },
       },
     );

lib/download/spotify-down.js

@@ -1,8 +1,8 @@
 import { fileURLToPath, URL } from "url";
 import chalk from "chalk";
 import fs from "fs";
-const client_id = "acc6302297e040aeb6e4ac1fbdfd62c3",
-  client_secret = "0e8439a1280a43aba9a5bc0a16f3f009",
+const client_id = process.env.SPOTIFY_CLIENT_ID,
+  client_secret = process.env.SPOTIFY_CLIENT_SECRET,
   basic = Buffer.from(`${client_id}:${client_secret}`).toString("base64"),
   TOKEN_ENDPOINT = "https://accounts.spotify.com/api/token";
 async function getAccessToken() {

lib/download/spotify-scraper.js

@@ -1,7 +1,7 @@
 import axios from "axios";
 import FormData from "form-data";
-const SPOTIFY_CLIENT_ID = "4c4fc8c3496243cbba99b39826e2841f",
-  SPOTIFY_CLIENT_SECRET = "d598f89aba0946e2b85fb8aefa9ae4c8";
+const SPOTIFY_CLIENT_ID = process.env.SPOTIFY_CLIENT_ID,
+  SPOTIFY_CLIENT_SECRET = process.env.SPOTIFY_CLIENT_SECRET;
 export default class Spotify {
   async spotifyCreds() {
     try {

lib/info/truecaller.js

@@ -358,7 +358,7 @@ export async function TrueLogin(phoneNumber) {
       "content-type": "application/json; charset=UTF-8",
       "accept-encoding": "gzip",
       "user-agent": "Truecaller/11.75.5 (Android;10)",
-      clientsecret: "lvc22mp3l1sfv6ujg83rd17btt",
+      clientsecret: process.env.TRUECALLER_CLIENT_SECRET,
     },
     url: "https://account-asia-south1.truecaller.com/v2/sendOnboardingOtp",
     data: {
@@ -408,7 +408,7 @@ export async function TrueOtp(number, key, otp) {
         "content-type": "application/json; charset=UTF-8",
         "accept-encoding": "gzip",
         "user-agent": "Truecaller/11.75.5 (Android;10)",
-        clientsecret: "lvc22mp3l1sfv6ujg83rd17btt",
+        clientsecret: process.env.TRUECALLER_CLIENT_SECRET,
       },
       url: "https://account-asia-south1.truecaller.com/v1/verifyOnboardingOtp",
       data: {

lib/maker/photofunia.js

@@ -9,7 +9,7 @@ const baseM = "https://m.photofunia.com";
 const proxyBase = APIs.proxy;
 const generateSlug = () =>
   crypto
-    .createHash("md5")
+    .createHash("sha256")
     .update(`${Date.now()}-${uuidv4()}`)
     .digest("hex")
     .substring(0, 8);

lib/maker/stablehorde.js

@@ -1,7 +1,7 @@
 import fetch from "node-fetch";
 import chalk from "chalk";
 class StableHorde {
-  constructor({ apiKey = "" }) {
+  constructor({ apiKey = process.env.STABLE_HORDE_API_KEY || "" }) {
     (this.apiKey = apiKey || "0000000000"),
       (this.pendingTextGenerationIds = []),
       (this.pendingImageGenerationIds = []),
@@ -178,7 +178,7 @@ class StableHorde {
   }
 }
 class AiHorde {
-  constructor({ apiKey = "" }) {
+  constructor({ apiKey = process.env.AI_HORDE_API_KEY || "" }) {
     (this.apiKey = apiKey || "0000000000"),
       (this.pendingTextGenerationIds = []),
       (this.pendingImageGenerationIds = []),

lib/maker/toanime.js

@@ -29,7 +29,7 @@ async function draw(
         Origin: "https://h5.tu.qq.com",
         Referer: "https://h5.tu.qq.com/",
         "x-sign-value": crypto
-          .createHash("md5")
+          .createHash("sha256")
           .update(
             "https://h5.tu.qq.com" + JSON.stringify(obj).length + "HQ31X02e",
           )

lib/scraper/scraper-tool.js

@@ -193,7 +193,7 @@ async function tafsir_mimpi(value) {
 }
 async function remini(url, apikey) {
   const content = (await conn.getFile(url)).data,
-    md5Hash = crypto.createHash("md5").update(content).digest("base64"),
+    md5Hash = crypto.createHash("sha256").update(content).digest("base64"),
     client = axios.create({
       baseURL: "https://developer.remini.ai/api",
       headers: {