-
Notifications
You must be signed in to change notification settings - Fork 328
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
signPayload/verifySignature in webhooks.ts have no protection against an empty or missing subscriber secret
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1315 In Disciplr-Org/Disciplr-backend;webhookSubscriberRepository.ts's SubscriberRow.events type assumes the DB driver always returns a real array
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1313 In Disciplr-Org/Disciplr-backend;resolveKeys() rejects the whole configuration on a single malformed key instead of skipping just that entry
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1300 In Disciplr-Org/Disciplr-backend;vaultTransitions.ts's getTransitionError computes 'failed' eligibility from Date comparisons with no timezone/skew handling
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1299 In Disciplr-Org/Disciplr-backend;buildVersionedPayload's v2 schema omits eventId and organizationId from the signed body, unlike v1
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1298 In Disciplr-Org/Disciplr-backend;getPendingCount and getDueCount in deferredReminders.service.ts are dead code, never exposed by any endpoint
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1297 In Disciplr-Org/Disciplr-backend;getVerifierStats issues four separate COUNT queries per call instead of one combined aggregate query
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1296 In Disciplr-Org/Disciplr-backend;buildEmbeddingText in evidenceReindex.ts silently drops the description when it's an empty string rather than null
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1295 In Disciplr-Org/Disciplr-backend;isValidTimeFormat's regex accepts '24:00'-adjacent edge cases inconsistently with parseTimeToMinutes' assumptions
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1294 In Disciplr-Org/Disciplr-backend;webhookVerify's raw-body size check destroys the socket without responding, leaving the client hanging
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1293 In Disciplr-Org/Disciplr-backend;getChangedFields-driven audit action lookup throws a generic Error instead of a typed, catchable exception
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1286 In Disciplr-Org/Disciplr-backend;AsyncMutex's waitQueue in exportQuota.ts's local mutex is unbounded and never times out
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStellar WaveIssues in the Stellar wave programIssues in the Stellar wave programStatus: Open.#1285 In Disciplr-Org/Disciplr-backend;