[richiemcilroy]

Older HLS recordings (local and MediaConvert sources) on default storage now get a playlist from /api/playlist whose URIs are absolute signed URLs, instead of a redirect to the stored .m3u8.

sequenceDiagram
    participant P as Player
    participant A as /api/playlist
    participant S as Storage
    P->>A: GET ?videoType=master|video
    A->>S: read stream.m3u8 or output/video_recording_000.m3u8
    opt multivariant playlist
        A->>S: read first rendition playlist
    end
    A-->>P: media playlist, every URI signed
    P->>S: segment_000.ts?Policy=...&Signature=...

Loading

• Instant segment playlists already list absolute signed URLs. Older HLS playlists now match them, so playback no longer depends on how each player resolves relative URIs against a redirected playlist URL.
• The route now reads the playlist, resolves each URI against the playlist's folder, and signs it (apps/web/app/api/playlist/route.ts:425). Comment and tag lines and absolute URIs pass through unchanged.
• Stored MediaConvert multivariant playlists carry a single rendition, so the first rendition is served directly rather than handing the player another relative child playlist.
• Missing playlists return 404 instead of a redirect to a missing object.
• MP4 sources and videoType=mp4 still redirect to a signed URL, as before. Custom buckets and Instant segment playlists are untouched.
• Signed segment URLs expire like every other signed URL. The HLS player already reloads the playlist on 403/410 (apps/web/app/s/[videoId]/_components/HLSVideoPlayer.tsx:430).

#EXTINF:4,
segment_000.ts

becomes

#EXTINF:4,
https://<cdn>/<owner>/<video>/combined-source/segment_000.ts?Policy=...&Key-Pair-Id=...&Signature=...

Confidence Score: 5/5

The changes since the previous review appear safe to merge.

Summary

Legacy HLS playlists on default storage now return signed segment URLs instead of redirects.

• Legacy HLS requests return playlists with signed segment URLs.

_{Reviews (2) · Last reviewed commit: "fix(web): cap the URIs signed for one le..." · Reviewed by Greptile}

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
cap-status	Skipped		Oct 29, 2026 7:46pm UTC

[capy-ai]

Capy found no issues.

View 1 other finding in Capy.

[superagent-security]

Superagent found 1 security concern(s).

[richiemcilroy]

hey @greptileai, please re-review the PR

[capy-ai]

Capy found no issues.