your spotify - Moses Yebei

The Problem

Spotify's built-in "Wrapped" gives you stats once a year. your_spotify solves that by continuously polling the Spotify API and storing your listening history in MongoDB, then presenting it through a self-hosted dashboard. You get persistent, queryable statistics instead of an annual snapshot.

What This Does

The repo is a fork of Yooooomi/your_spotify (4,547 stars upstream). It's a monorepo with two applications under apps/: a Node/Express server (apps/server) that polls Spotify's API and writes to MongoDB, and a React client (apps/client) that renders the statistics dashboard. The server handles OAuth with Spotify, imports historical data from Spotify's privacy export, and serves the REST API. The client is a TypeScript/React SPA with Redux state management, charts, and playlist management.

How It Is Wired

The entry point is apps/client/src/App.tsx, which mounts the React tree and sets up routing. The client talks to the server through apps/client/src/services/apis/api.ts, which wraps all REST calls. That module is a hub with 45 incoming dependencies and sits inside an import cycle with apps/client/src/services/redux/modules/user/selector.ts and apps/client/src/services/redux/tools.ts — changing the API layer touches nearly every feature, and the cycle makes refactoring harder than it should be.

The server side polls Spotify's API via apps/server/src/tools/apis/spotifyApi.ts, which has deep nesting (indentation depth 6) and is a candidate for refactoring with guard clauses. Data flows from Spotify → server → MongoDB → client API → Redux store → UI components. The most-connected module is apps/client/src/components/Text/index.ts with 68 dependents; it's a stable, low-churn component, but any change there has wide blast radius.

The client uses Redux with hooks (apps/client/src/services/hooks/hooks.ts, 47 dependents) and a typed service layer (apps/client/src/services/types.ts, 53 dependents). The App.tsx component imports 28 modules, making it the top-level integration point.

How To Use It

Setup: Clone and install with pnpm (the package manager is pnpm per the lockfile):

git clone https://github.com/moses-y/your_spotify
cd your_spotify
pnpm install

Configuration: Required environment variables, per the README: CLIENT_ENDPOINT, API_ENDPOINT, SPOTIFY_PUBLIC, SPOTIFY_SECRET, and optionally TIMEZONE and MONGO_ENDPOINT. You must create a Spotify application via their developer dashboard and add your redirect URI.

Running it: The README documents Docker Compose as the recommended path. The repo includes Dockerfile.client, Dockerfile.server, and production variants. For local development, follow LOCAL_INSTALL.md — the client entry point is apps/client/scripts/run/run.sh and the server starts via its own scripts under apps/server/scripts/.

Real-World Use

Self-hosted listening analytics: deploy the server and client containers behind a reverse proxy, point them at a MongoDB instance, and let the server poll Spotify every few minutes. The dashboard shows top artists, songs, albums, listening time, and trends over custom date ranges. You can also import your full Spotify privacy export (JSON files) via the server's import endpoint to backfill history before the tracker was installed.

Code Health & Issues

Static analysis found 63 findings (37 high, 26 medium) across 5 kinds:

High – Import cycles (28 instances): apps/client/src/services/apis/api.ts, apps/client/src/services/redux/modules/user/selector.ts, apps/client/src/services/redux/tools.ts participate in circular imports. Fix: extract shared types or invert dependencies.
High – Hub modules (21 instances): apps/client/src/components/Text/index.ts (68 dependents), apps/client/src/services/types.ts (53), apps/client/src/services/hooks/hooks.ts (47). Keep these stable.
High – Deep nesting (9 instances): apps/server/src/tools/apis/spotifyApi.ts, apps/server/src/database/queries/user.ts, apps/client/src/components/ThreePoints/ThreePoints.tsx hit indentation depth 6. Flatten with early returns.
High – Duplicated code (254 repeated blocks across 50 files): History.tsx, Songs.tsx, Track.tsx, Album.tsx. Extract shared helpers.
Medium – High branching density: apps/client/src/scenes/ArtistStats/ArtistRank/ArtistRank.tsx has 20 branch points over 51 lines.

SDLC observations from the structure: no test files exist despite 387 source files (high risk), GitHub Actions workflows don't pin action versions to commit SHAs (supply-chain risk), no permissions block on workflows, no Dependabot config, and Dockerfiles use mutable base image tags (node:25-alpine) without digests. No committed secrets were detected.

The Bottom Line

A functional self-hosted Spotify tracker with a solid feature set inherited from a popular upstream project. The main risks are the absence of tests, circular imports in the core API layer, and CI/CD hygiene gaps. Worth using if you want persistent listening stats and control over your data, but budget time for hardening before relying on it in production.

What the analyser found

Deployment readiness

6/7

Container image
CI pipeline
Lockfile committed
Test suite
README
License
No committed secrets

Composition

526 files

TypeScript249
TSX134
CSS82
Shell11
JSON9
YAML8

ReactExpressDocker

Module dependencies

The 10 most depended-upon modules of 377, from static import analysis. Red outline marks a module in an import cycle.

graph LR n0_nt_src_components_Text_index["index"] n1_ps_client_src_services_types["types"] n2_ent_src_services_hooks_hooks["hooks"] n3_client_src_services_apis_api["api"] n4__redux_modules_user_selector["selector"] n5_c_components_TitleCard_index["index"] n6_ent_src_services_redux_tools["tools"] n7_ps_client_src_services_stats["stats"] n8_ps_server_src_database_index["index"] n9_apps_server_src_tools_logger["logger"] n3_client_src_services_apis_api --> n1_ps_client_src_services_types n2_ent_src_services_hooks_hooks --> n4__redux_modules_user_selector n2_ent_src_services_hooks_hooks --> n1_ps_client_src_services_types n7_ps_client_src_services_stats --> n1_ps_client_src_services_types n8_ps_server_src_database_index --> n9_apps_server_src_tools_logger classDef cyc stroke:#ef4444,stroke-width:2px; class n3_client_src_services_apis_api,n4__redux_modules_user_selector,n6_ent_src_services_redux_tools,n8_ps_server_src_database_index cyc;

Findings

MediumNo test files detected - untested code paths repository-wide

What would stop me shipping this

Ranked by severity × confidence × production reach. Reach is the honest discriminator across a collection that is mostly other people's code: the same finding matters more in something that ships.

high2

medium6

low2

Pin third-party GitHub Actions to a commit SHAhigh6 occurrences

.github/workflows

docker/setup-qemu-action@v3, docker/setup-buildx-action@v3, docker/metadata-action@v5, docker/login-action@v3

A tag can be moved, so the action running with your token and secrets is whatever its owner last pushed; this is how tj-actions/changed-files leaked secrets from thousands of repos.

Fix: Replace each @vN with the 40-character commit SHA, keep # vN as a comment, and let Dependabot bump the SHAs.

Add a test suite; this repository has nonehigh387 occurrences

387 source files, no test files

Any change ships with no signal that existing behaviour still holds, so a regression reaches production undetected.

Fix: Add one test per public entry point, then a CI step that runs them.

Declare least-privilege permissions for GITHUB_TOKENmedium2 occurrences

.github/workflows/nightly.yml

2 workflow(s) declare no permissions, 2 of them reference secrets

With no declaration the token inherits the repository default, so any injected step can push commits or mint releases from inside your own CI.

Fix: Add permissions: contents: read at the top of the workflow and widen per job only where needed.

Enable Dependabot or Renovatemedium

4 manifest(s), no update bot configured

Without a bot a published advisory sits unpatched until someone audits by hand, which across 1,322 repositories means never.

Fix: Commit .github/dependabot.yml covering the repo ecosystems plus github-actions.

Pin the container base image by digestmedium

Dockerfile.client

node:25-alpine

An untagged or mutable base means today's build and last month's contain different libc and a different CVE set, with no record of which shipped.

Fix: Use image:tag@sha256:<digest> and enable Dependabot's docker ecosystem.

Gate pull requests on a dependency vulnerability scanmedium

.github/workflows

no dependency scan in CI

This is the one gate that would catch a known-vulnerable package before it reaches a build, and no repository in the sample had it.

Fix: Add dependency-review-action on pull_request, or osv-scanner on push and a schedule.

Set persist-credentials: false on checkoutmedium

.github/workflows/nightly.yml

checkout keeps the token, then dependencies are installed

The token stays in .git/config for every later step, so a malicious postinstall script reads a pushable credential without one ever being passed to it.

Fix: Add with: persist-credentials: false, and pass an explicit token only to the step that pushes.

Add a non-root USER to the imagemedium

Dockerfile.client

CMD or ENTRYPOINT with no USER directive

A process running as root in the container is root against every mounted volume, and it turns any container escape or writable-mount mistake from a contained problem into a host one.

Fix: Create an unprivileged user, chown what it needs, and end the Dockerfile with USER.

Set timeout-minutes on the workflow jobslow2 occurrences

.github/workflows/nightly.yml

2 workflow(s) declare no job timeout

A wedged step runs to the six-hour platform default, which on a two-hourly schedule means three runs overlap behind it.

Fix: Add timeout-minutes with a realistic bound to each job.

Add the repository convention files this project lackslow3 occurrences

missing .editorconfig, .gitattributes, a formatter config

Without them one contributor's editor writes tabs into a Python file, a shell script commits with CRLF and fails in the container, and a notebook diff is unreviewable.

Fix: Add .editorconfig, .gitattributes with text=auto eol=lf, and a formatter config.

Checked deterministically against the repository tree and a bounded set of its files: committed credentials, unpinned actions and base images, missing lockfiles and update bots, workflows that discard failures, published advisories against the declared dependencies, runtime configuration, licensing and notebook reproducibility. No language model is involved in this section.