-
Notifications
You must be signed in to change notification settings - Fork 351
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
getDefaultPreferences returns id: '' for users with no stored row, which callers could mistake for a real record id
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1441 In Disciplr-Org/Disciplr-backend;recordVerification's conflict handling only compares result, ignoring changes to evidenceHash or disputed on a repeat call
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1440 In Disciplr-Org/Disciplr-backend;getFieldEncryptionConfig-driven key rotation has no mechanism to confirm all data was re-encrypted before retiring a key
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1439 In Disciplr-Org/Disciplr-backend;AsyncMutex in exportQuota.ts and the per-request idempotency queue in idempotency.ts duplicate the same wait-queue pattern
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1438 In Disciplr-Org/Disciplr-backend;validateSignedObjectStorageUrl runs SSRF validation only after already parsing/trusting the expiry, not before
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1437 In Disciplr-Org/Disciplr-backend;AbuseMonitor's sanitizeIdentifier hash truncated to 12 hex chars increases collision risk across distinct actors
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1436 In Disciplr-Org/Disciplr-backend;createEvidenceReference's ON CONFLICT (verification_id) silently overwrites a prior evidence reference with no audit trail
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1435 In Disciplr-Org/Disciplr-backend;resolveKeys() rejects the whole configuration on a single malformed key instead of skipping just that entry
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1434 In Disciplr-Org/Disciplr-backend;vaultTransitions.ts's getTransitionError computes 'failed' eligibility from Date comparisons with no timezone/skew handling
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1433 In Disciplr-Org/Disciplr-backend;buildVersionedPayload's v2 schema omits eventId and organizationId from the signed body, unlike v1
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1432 In Disciplr-Org/Disciplr-backend;getPendingCount and getDueCount in deferredReminders.service.ts are dead code, never exposed by any endpoint
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1431 In Disciplr-Org/Disciplr-backend;getVerifierStats issues four separate COUNT queries per call instead of one combined aggregate query
GRANTFOX OSSGrantFox open-source campaignGrantFox open-source campaignMAYBE REWARDEDEligible for GrantFox rewardEligible for GrantFox rewardOfficial Campaign | FWC26Official FWC26 campaign taskOfficial FWC26 campaign taskStatus: Open.#1430 In Disciplr-Org/Disciplr-backend;