Gallery · App X-Ray

FreeTube 0.25.3

Electron 44.9.2 · 37 addresses · 153 modules · 0 IPC channels

0 high
0 medium
0 low
3 info

Findings

info

Electron 44.9.2 is supported

as of 2026-10-22, Electron 43–45 are supported.

info

IPC channel names chosen at runtime

69 IPC calls take the channel name from a variable. When a preload script forwards a channel chosen by the page, the page can reach every handler; worth reviewing.

info

Stores data on this device

Uses session-storage (7 uses), cache-storage (1 use).

src/renderer/helpers/api/local.js:493 · src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js:1245 · src/renderer/store/modules/settings.js:401 · src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js:2781 · src/renderer/store/modules/settings.js:402 · static/pwabuilder-sw.js:140 · src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js:1237 · src/renderer/store/modules/settings.js:403

Network addresses

Host	Address	How	Where
—	/	property:path	src/renderer/router/index.js:22
—	/about	property:path	src/renderer/router/index.js:88
—	/Applications	property:path	_scripts/ebuilder.config.mjs:36
—	/channel/:id/:currentTab?	property:path	src/renderer/router/index.js:118
—	/hashtag/:hashtag	property:path	src/renderer/router/index.js:132
—	/history	property:path	src/renderer/router/index.js:72
—	/playlist/:id	property:path	src/renderer/router/index.js:111
—	/popular	property:path	src/renderer/router/index.js:56
—	/post/:id	property:path	src/renderer/router/index.js:139
—	/search/:query	property:path	src/renderer/router/index.js:104
—	/settings	property:path	src/renderer/router/index.js:80
—	/settings/profile	property:path	src/renderer/router/index.js:96
—	/subscribedchannels	property:path	src/renderer/router/index.js:38
—	/subscriptions	property:path	src/renderer/router/index.js:30
—	/trending	property:path	src/renderer/router/index.js:47
—	/userplaylists	property:path	src/renderer/router/index.js:64
—	/watch/:id	property:path	src/renderer/router/index.js:125
—	buildURL('GenerateIT', true)	call:fetch	src/botGuardScript.js:83
—	caption.url	call:fetch	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js:2999
gpu	chrome://gpu	call:gpuWindow.loadURL	src/main/index.js:2470
—	ContinuationItem	call:memo.get	src/renderer/helpers/api/local.js:1203
—	data:text/html,<!DOCTYPE html><html lang="en"><head><title></title></head><body></body></html>	call:webContentsView.webContents.loadURL	src/main/poTokenGenerator.js:191
—	event.request	call:fetch	static/pwabuilder-sw.js:88
—	GridPlaylist	call:memo.get	src/renderer/helpers/api/local.js:1200
api.invidious.io	https://api.invidious.io/instances.json	call:fetch	_scripts/getInstances.js:4
www.youtube.com	https://www.youtube.com/youtubei/v1/att/get?prettyPrint=false&alt=json	call:fetch	src/botGuardScript.js:27
—	input	call:fetch	src/renderer/helpers/utils.js:913
—	interpreterUrl	call:fetch	src/botGuardScript.js:63
—	LockupView	call:memo.get	src/renderer/helpers/api/local.js:1200
—	Playlist	call:memo.get	src/renderer/helpers/api/local.js:1200
—	playlistId	call:params.get	src/main/index.js:191
—	playlistType	call:params.get	src/main/index.js:190
—	requestUrl	call:fetch	src/renderer/helpers/sponsorblock.js:39
—	sabrURL.toString()	call:fetch	src/renderer/helpers/player/SabrSchemePlugin.js:340
—	timestamp	call:params.get	src/main/index.js:196
—	url	call:fetch	src/renderer/store/modules/invidious.js:32
localhost	ws://localhost:9080/ws	call:WebSocket	src/renderer/i18n/index.js:54

Modules

Module	Used by
../../../../constants	src/renderer/components/ft-shaka-video-player/player-components/AudioTrackSelection.js, src/renderer/components/ft-shaka-video-player/player-components/AutoplayToggle.js, src/renderer/components/ft-shaka-video-player/player-components/FullWindowButton.js, src/renderer/components/ft-shaka-video-player/player-components/LegacyQualitySelection.js, src/renderer/components/ft-shaka-video-player/player-components/ScreenshotButton.js, src/renderer/components/ft-shaka-video-player/player-components/SkipButton.js, src/renderer/components/ft-shaka-video-player/player-components/StatsButton.js, src/renderer/components/ft-shaka-video-player/player-components/TheatreModeButton.js
../../../../node_modules/youtubei.js/dist/protos/generated/misc/params	src/renderer/helpers/api/shared.js
../../../constants	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js, src/renderer/helpers/api/local.js, src/renderer/store/modules/profiles.js, src/renderer/store/modules/search-history.js, src/renderer/store/modules/settings.js
../../../datastores/handlers/index	src/renderer/store/modules/history.js, src/renderer/store/modules/playlists.js, src/renderer/store/modules/profiles.js, src/renderer/store/modules/search-history.js, src/renderer/store/modules/settings.js, src/renderer/store/modules/subscription-cache.js
../../../helpers/player/utils	src/renderer/components/ft-shaka-video-player/player-components/AudioTrackSelection.js
../../../helpers/utils	src/renderer/components/ft-shaka-video-player/player-components/FullWindowButton.js, src/renderer/components/ft-shaka-video-player/player-components/ScreenshotButton.js, src/renderer/components/ft-shaka-video-player/player-components/SkipButton.js, src/renderer/components/ft-shaka-video-player/player-components/StatsButton.js, src/renderer/components/ft-shaka-video-player/player-components/TheatreModeButton.js
../../../i18n/index	src/renderer/components/ft-shaka-video-player/player-components/AudioTrackSelection.js, src/renderer/components/ft-shaka-video-player/player-components/AutoplayToggle.js, src/renderer/components/ft-shaka-video-player/player-components/FullWindowButton.js, src/renderer/components/ft-shaka-video-player/player-components/ScreenshotButton.js, src/renderer/components/ft-shaka-video-player/player-components/SkipButton.js, src/renderer/components/ft-shaka-video-player/player-components/StatsButton.js, src/renderer/components/ft-shaka-video-player/player-components/TheatreModeButton.js
../../components/CommentSection/CommentSection.vue	src/renderer/views/Watch/Watch.js
../../components/ft-shaka-video-player/ft-shaka-video-player.vue	src/renderer/views/Watch/Watch.js
../../components/FtAgeRestricted/FtAgeRestricted.vue	src/renderer/views/Watch/Watch.js
../../components/FtLoader/FtLoader.vue	src/renderer/views/Watch/Watch.js
../../components/WatchVideoChapters/WatchVideoChapters.vue	src/renderer/views/Watch/Watch.js
../../components/WatchVideoDescription/WatchVideoDescription.vue	src/renderer/views/Watch/Watch.js
../../components/WatchVideoInfo/WatchVideoInfo.vue	src/renderer/views/Watch/Watch.js
../../components/WatchVideoLiveChat/WatchVideoLiveChat.vue	src/renderer/views/Watch/Watch.js
../../components/WatchVideoPlaylist/WatchVideoPlaylist.vue	src/renderer/views/Watch/Watch.js
../../components/WatchVideoRecommendations/WatchVideoRecommendations.vue	src/renderer/views/Watch/Watch.js
../../constants	src/datastores/handlers/electron.js, src/renderer/helpers/utils.js
../../helpers/api/invidious	src/renderer/views/Watch/Watch.js
../../helpers/api/local	src/renderer/views/Watch/Watch.js
../../helpers/colors	src/renderer/store/modules/profiles.js, src/renderer/views/Watch/Watch.js
../../helpers/player/SabrManifestParser	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js, src/renderer/views/Watch/Watch.js
../../helpers/player/SabrSchemePlugin	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js
../../helpers/player/utils	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js, src/renderer/views/Watch/Watch.js
../../helpers/playlists	src/renderer/store/modules/playlists.js
../../helpers/utils	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js, src/renderer/store/modules/invidious.js, src/renderer/store/modules/player.js, src/renderer/store/modules/playlists.js, src/renderer/store/modules/profiles.js, src/renderer/store/modules/settings.js, src/renderer/store/modules/utils.js, src/renderer/views/Watch/Watch.js
../../i18n/index	src/renderer/helpers/player/utils.js, src/renderer/store/modules/settings.js, src/renderer/store/modules/utils.js
../../store/index	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js, src/renderer/helpers/api/invidious.js
../constants	src/main/externalPlayer.js, src/main/index.js
../datastores/handlers/base	src/main/externalPlayer.js, src/main/index.js
../helpers/utils	src/renderer/i18n/index.js
../i18n/index	src/renderer/helpers/strings.js, src/renderer/helpers/utils.js
../index	src/datastores/handlers/base.js
../router/index	src/renderer/helpers/utils.js
../sponsorblock	src/renderer/helpers/player/utils.js
../store/index	src/renderer/helpers/sponsorblock.js, src/renderer/helpers/subscriptions.js
../strings	src/renderer/helpers/api/invidious.js
../utils	src/renderer/helpers/api/invidious.js, src/renderer/helpers/api/local.js, src/renderer/helpers/player/SabrSchemePlugin.js
../views/About/About.vue	src/renderer/router/index.js
../views/Channel/Channel.vue	src/renderer/router/index.js
../views/Hashtag/Hashtag.vue	src/renderer/router/index.js
../views/History/History.vue	src/renderer/router/index.js
../views/Playlist/Playlist.vue	src/renderer/router/index.js
../views/Popular/Popular.vue	src/renderer/router/index.js
../views/Post.vue	src/renderer/router/index.js
../views/ProfileSettings/ProfileSettings.vue	src/renderer/router/index.js
../views/SearchPage/SearchPage.vue	src/renderer/router/index.js
../views/Settings/Settings.vue	src/renderer/router/index.js
../views/SubscribedChannels/SubscribedChannels.vue	src/renderer/router/index.js
../views/Subscriptions/Subscriptions.vue	src/renderer/router/index.js
../views/Trending/Trending.vue	src/renderer/router/index.js
../views/UserPlaylists/UserPlaylists.vue	src/renderer/router/index.js
../views/Watch/Watch.vue	src/renderer/router/index.js
./api/invidious	src/renderer/helpers/channels.js
./api/local	src/renderer/helpers/channels.js
./App.vue	src/renderer/main.js
./base	src/datastores/handlers/web.js
./EbmlParser	src/renderer/helpers/player/WebmSegmentIndexParser.js
./externalPlayer	src/main/index.js
./fontawesome-minimal	src/renderer/main.js
./helpers/utils	src/renderer/main.js
./i18n/index	src/renderer/main.js
./ImageCache	src/main/index.js
./modules/history	src/renderer/store/index.js
./modules/invidious	src/renderer/store/index.js
./modules/player	src/renderer/store/index.js
./modules/playlists	src/renderer/store/index.js
./modules/profiles	src/renderer/store/index.js
./modules/search-history	src/renderer/store/index.js
./modules/settings	src/renderer/store/index.js
./modules/subscription-cache	src/renderer/store/index.js
./modules/utils	src/renderer/store/index.js
./Mp4SegmentIndexParser	src/renderer/helpers/player/SabrManifestParser.js
./player-components/AudioTrackSelection	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js
./player-components/AutoplayToggle	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js
./player-components/FullWindowButton	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js
./player-components/LegacyQualitySelection	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js
./player-components/ScreenshotButton	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js
./player-components/SkipButton	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js
./player-components/StatsButton	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js
./player-components/TheatreModeButton	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js
./PlayerCache	src/renderer/helpers/api/local.js
./poTokenGenerator	src/main/index.js
./router/index	src/renderer/main.js
./shared	src/renderer/helpers/api/invidious.js, src/renderer/helpers/api/local.js
./store/index	src/renderer/main.js
./utils	src/main/externalPlayer.js, src/main/index.js, src/renderer/helpers/colors.js
./WebmSegmentIndexParser	src/renderer/helpers/player/SabrManifestParser.js
@double-great/stylelint-a11y	stylelint.config.mjs
@eslint/js	eslint.config.mjs
@fortawesome/fontawesome-svg-core/plugins	src/renderer/fontawesome-minimal.js
@fortawesome/fontawesome-svg-core/styles.css	src/renderer/main.js
@fortawesome/free-brands-svg-icons	src/renderer/main.js
@fortawesome/free-regular-svg-icons	src/renderer/main.js
@fortawesome/free-solid-svg-icons	src/renderer/main.js
@fortawesome/vue-fontawesome	src/renderer/main.js
@intlify/eslint-plugin-vue-i18n	eslint.config.mjs
@magda/tree-kill	_scripts/dev-runner.js
@seald-io/nedb	src/datastores/index.js
@stylistic/eslint-plugin	eslint.config.mjs
autolinker	src/renderer/helpers/api/invidious.js, src/renderer/helpers/api/local.js
bgutils-js/botguard	src/botGuardScript.js
bgutils-js/utils	src/botGuardScript.js, src/renderer/helpers/api/local.js
bgutils-js/webpo	src/botGuardScript.js
child_process	_scripts/dev-runner.js, src/main/index.js
crypto	_scripts/sigFrameConfig.js
DB_HANDLERS_ELECTRON_RENDERER_OR_WEB	src/datastores/handlers/index.js
dompurify	src/renderer/directives/vSaferHtml.js
electron	_scripts/dev-runner.js, src/datastores/index.js, src/main/index.js, src/main/poTokenGenerator.js
electron-builder	_scripts/build.mjs
electron-context-menu	src/main/index.js
electron/renderer	src/preload/interface.js, src/preload/main.js
eslint-plugin-import-x	eslint.config.mjs
eslint-plugin-jsdoc	eslint.config.mjs
eslint-plugin-jsonc	eslint.config.mjs
eslint-plugin-n	eslint.config.mjs
eslint-plugin-promise	eslint.config.mjs
eslint-plugin-unicorn	eslint.config.mjs
eslint-plugin-vue	eslint.config.mjs
eslint-plugin-vuejs-accessibility	eslint.config.mjs
eslint-plugin-yml	eslint.config.mjs
eslint/config	eslint.config.mjs
fs	_scripts/ProcessLocalesPlugin.js, _scripts/getRegions.mjs, _scripts/getShakaLocales.js, _scripts/injectAllowedPaths.mjs, _scripts/sigFrameConfig.js, _scripts/webpack.renderer.config.js, _scripts/webpack.web.config.js, src/datastores/index.js, src/main/index.js
fs/promises	_scripts/ProcessLocalesPlugin.js, _scripts/clean.mjs, _scripts/getInstances.js, src/main/index.js, src/main/poTokenGenerator.js
globals	eslint.config.mjs
googlevideo/protos	src/renderer/helpers/player/SabrSchemePlugin.js
googlevideo/ump	src/renderer/helpers/player/SabrSchemePlugin.js
googlevideo/utils	src/renderer/helpers/player/SabrSchemePlugin.js
html-webpack-plugin	_scripts/webpack.renderer.config.js, _scripts/webpack.web.config.js
js-yaml	_scripts/ProcessLocalesPlugin.js, _scripts/findMissingTemplates.mjs
mini-css-extract-plugin	_scripts/webpack.renderer.config.js, _scripts/webpack.web.config.js
minimizer-webpack-plugin	_scripts/webpack.main.config.js, _scripts/webpack.renderer.config.js, _scripts/webpack.web.config.js
node:child_process	src/main/externalPlayer.js
node:fs	_scripts/findMissingTemplates.mjs
node:fs/promises	src/main/externalPlayer.js
node:path	_scripts/findMissingTemplates.mjs, src/main/externalPlayer.js
path	_scripts/ProcessLocalesPlugin.js, _scripts/clean.mjs, _scripts/dev-runner.js, _scripts/getRegions.mjs, _scripts/getShakaLocales.js, _scripts/injectAllowedPaths.mjs, _scripts/sigFrameConfig.js, _scripts/webpack.botGuardScript.config.js, _scripts/webpack.main.config.js, _scripts/webpack.preload.config.js, _scripts/webpack.renderer.config.js, _scripts/webpack.web.config.js, src/datastores/index.js, src/main/index.js, src/main/poTokenGenerator.js
sass	_scripts/webpack.renderer.config.js, _scripts/webpack.web.config.js
shaka-player	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js, src/renderer/components/ft-shaka-video-player/player-components/AudioTrackSelection.js, src/renderer/components/ft-shaka-video-player/player-components/AutoplayToggle.js, src/renderer/components/ft-shaka-video-player/player-components/FullWindowButton.js, src/renderer/components/ft-shaka-video-player/player-components/LegacyQualitySelection.js, src/renderer/components/ft-shaka-video-player/player-components/ScreenshotButton.js, src/renderer/components/ft-shaka-video-player/player-components/SkipButton.js, src/renderer/components/ft-shaka-video-player/player-components/StatsButton.js, src/renderer/components/ft-shaka-video-player/player-components/TheatreModeButton.js, src/renderer/helpers/player/EbmlParser.js, src/renderer/helpers/player/Mp4SegmentIndexParser.js, src/renderer/helpers/player/SabrManifestParser.js, src/renderer/helpers/player/SabrSchemePlugin.js, src/renderer/helpers/player/WebmSegmentIndexParser.js, src/renderer/helpers/player/utils.js, src/renderer/views/Watch/Watch.js
stylelint-use-logical-spec	stylelint.config.mjs
swiper/element	src/renderer/main.js
terser	_scripts/sigFrameConfig.js
util	_scripts/ProcessLocalesPlugin.js, src/main/index.js
vue	src/renderer/components/ft-card/ft-card.js, src/renderer/components/ft-flex-box/ft-flex-box.js, src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js, src/renderer/composables/colors.js, src/renderer/helpers/utils.js, src/renderer/main.js, src/renderer/views/Watch/Watch.js
vue-eslint-parser	eslint.config.mjs
vue-i18n	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js, src/renderer/composables/colors.js, src/renderer/i18n/index.js, src/renderer/views/Watch/Watch.js
vue-loader	_scripts/webpack.renderer.config.js, _scripts/webpack.web.config.js
vue-router	src/renderer/router/index.js, src/renderer/views/Watch/Watch.js
vuex	src/renderer/store/index.js, src/renderer/views/Watch/Watch.js
webpack	_scripts/dev-runner.js, _scripts/webpack.main.config.js, _scripts/webpack.renderer.config.js, _scripts/webpack.web.config.js
webpack-dev-server	_scripts/dev-runner.js
youtubei.js	_scripts/getRegions.mjs, src/renderer/helpers/api/invidious.js, src/renderer/helpers/api/local.js, src/renderer/helpers/api/shared.js, src/renderer/views/Watch/Watch.js
zlib	_scripts/ProcessLocalesPlugin.js, src/main/index.js

Windows and IPC

Window	webPreferences
src/main/index.js:1022	defaults
src/main/index.js:2463	devTools=false

No IPC channels found.

Remote pages, data and packaging

No remote pages are loaded into app windows.

Storage	How	Where
session-storage	call:sessionStorage.setItem	src/renderer/helpers/api/local.js:493
session-storage	call:sessionStorage.setItem	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js:1245
session-storage	call:sessionStorage.setItem	src/renderer/store/modules/settings.js:401
session-storage	call:sessionStorage.getItem	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js:2781
session-storage	call:sessionStorage.setItem	src/renderer/store/modules/settings.js:402
cache-storage	call:then	static/pwabuilder-sw.js:140
session-storage	call:sessionStorage.getItem	src/renderer/components/ft-shaka-video-player/ft-shaka-video-player.js:1237
session-storage	call:sessionStorage.setItem	src/renderer/store/modules/settings.js:403

No packaged executable was found, so Electron fuses were not read.

README badge

Maintainers can show this report in their README:

[![App X-Ray](https://Eliot5566.github.io/app-xray/apps/freetube/badge.svg)](https://Eliot5566.github.io/app-xray/apps/freetube/)

What this report cannot see

Source checkout: 30 test, story, build-tool and minified/generated files were left out. Rerun with --all-files to include them.
CommonJS and ESM binding relationships were recovered from inert syntax and resolved only within the inventoried artifact container.
Dynamic IPC channel expressions remain unresolved and are never paired by textual similarity.
Electron API identity follows proven lexical module aliases and structurally verified module-namespace interop. Other reassignments, dynamic selections, and visibly overwritten namespace members are unresolved; missing findings do not establish absence. Arbitrary call side effects and runtime registration are not evaluated.
Electron relationships are derived from inert syntax; runtime registration, reachability, defaults, and enforcement remain unproven.
Graph coverage is incomplete; unavailable facts remain explicit and must not be read as absence.
JavaScript and HTML were parsed as inert text; bundle bootstrap code was never executed.
Sender, frame, URL, and origin checks are observations only; REA does not claim that they enforce a complete authorization policy.
Static imports, entrypoints, workers, endpoints, and storage relationships do not prove runtime execution.
Static paths and relationships may remain unresolved when expressions are dynamic or obfuscated.
Webpack/Rspack factories were recovered from AST literals; REA did not invoke push handlers or bundle bootstrap code.