Loading...
Loading...
Music Without Middlemen
Creator-sovereign music distribution. Artists keep 90%+ of revenue. AI-powered DAW studio with beat/lyrics/melody generation. Part of Sporus.
15
Live
3
Partial
1
Stub
2
Missing
13/13
Pages
1/23
APIs
92%
Security
Audio + cover art upload with metadata and scheduling
Public artist profiles with track listings
Personal library, playlists, and track likes
UI has scheduling dialog, backend incomplete
No Spotify/Apple Music distribution connectors
Passwordless passkey authentication
Auto-creates artist profile from NoxSoft shared profile on first visit — no onboarding required
Stripe payments with 5% platform fee, 95% to creator
Onboarding, payout status, earnings tracking
No multi-artist revenue sharing
Genre-specific drum patterns via Claude API
Full/continue/rewrite modes with syllable counting
3 additional AI endpoints for music production
Sequencer/piano roll UI built, Tone.js playback partial
UI complete, audio processing partially integrated
Database schema ready, sharing UI not built
Cross-platform following from all 5 Sporus platforms
Tips, follows, and publishing event notifications
Perceptual hash duplicate detection
Per-content training/remix/style protections
Web Push via VAPID with service worker for tips, follows, and publishing notifications
| Check | Status |
|---|---|
| CSRF Protection | Pass |
| Rate Limiting | Pass |
| Input Validation | Pass |
| Security Headers | Pass |
| Auth / Session | Pass |
| Encryption | Partial |
No rate limiting — AI endpoints can be abused (expensive Anthropic calls)
optimize-image API has NO auth — unauthenticated users can upload/process images, no bucket whitelist
Missing CSP header — XSS risk on public profiles
No server-side file type verification — relies on extension only
tips/recent API endpoint unauthenticated — leaks creator financial data (earnings, supporter IDs) via service role
Passkey/WebAuthn RLS policies use USING(true) — any user can read/write all credentials
Username/bio fields lack output sanitization
Passkey challenge table has no cleanup job
Landing page showed "Sign In" when user already authenticated via SSO
check-copyright accepts untrusted userId from request body — user can attribute hashes to other users
content_ai_consent INSERT/UPDATE RLS open to all — any user can modify AI consent for any content
Studio audio engine partially integrated
23
Total Routes
1
Rate Limited
13
Total Pages
13
Live Pages