Issues

• [api] Restrict CORS to configured origins and add security headers to the deployed serverless API

  area-backendpriority:mediumStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1731 · Filter by author 1nonlypiece opened on Oct 18, 2026
  4

  

• [api] Add a verifier review queue endpoint to the deployed API with per-milestone due status

  area-backendpriority:mediumStellar Wavetype-feature
  Disciplr-Org/Disciplr-backend#1730 · Filter by author 1nonlypiece opened on Oct 18, 2026
  4

  

• [api-keys] Add expiry, last-used visibility and a dual-key rotation grace period for API keys

  area-backendpriority:mediumStellar Wavetype-feature
  Disciplr-Org/Disciplr-backend#1729 · Filter by author 1nonlypiece opened on Oct 18, 2026
  4

  

• [vaults] Enforce the state machine in POST /api/vaults/:id/cancel and stop reporting success when the update fails

  area-backendpriority:mediumStellar Wavetype-enhancement
  Disciplr-Org/Disciplr-backend#1728 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [audit] Serialise audit-log hash-chain appends per organisation so concurrent writes cannot fork the chain

  area-backendpriority:mediumStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1727 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [jobs] Drive on-chain slash_on_miss for expired vaults through the settlement operations ledger

  area-backendpriority:mediumStellar Wavetype-feature
  Disciplr-Org/Disciplr-backend#1726 · Filter by author 1nonlypiece opened on Oct 18, 2026
  4

  

• [soroban] Serialise transaction submission per source account and handle TRY_AGAIN_LATER, DUPLICATE and txBadSeq

  area-backendpriority:mediumStellar Wavetype-enhancement
  Disciplr-Org/Disciplr-backend#1725 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [soroban] Encode slash_on_miss, claim and withdraw invocations to match the accountability_vault ABI

  area-backendpriority:highStellar Wavetype-enhancement
  Disciplr-Org/Disciplr-backend#1724 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [webhooks] Resolve and pin webhook destinations to public IPs at delivery time to close SSRF bypasses

  area-backendpriority:highStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1723 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [auth] Throttle /auth/login per account and IP and make the mock userId login explicitly opt-in

  area-backendpriority:mediumStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1722 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [auth] Make refresh-token rotation atomic so concurrent reuse is detected instead of forking sessions

  area-backendpriority:mediumStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1721 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [auth] Bind step-up sessions to a verified WebAuthn assertion instead of the raw challenge nonce

  area-backendpriority:highStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1720 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [vaults] Scope vault and milestone read endpoints to the creator, assigned verifiers and admins

  area-backendpriority:highStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1719 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [vaults] Restrict PATCH /api/vaults/:id to authorised actors and an allow-list of editable fields

  area-backendpriority:highStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1718 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Generate the AccountabilityVault interface spec from the contract and fail CI on drift

  area-contractspriority:mediumStellar Wavetype-testing
  Disciplr-Org/Disciplr-backend#1717 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Guard dispute_milestone by vault state and reset approvals so disputed milestones can be re-verified

  area-contractspriority:mediumStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1716 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Pay verified-but-unclaimed milestones to the success destination before slashing the remainder

  area-contractspriority:mediumStellar Wavetype-enhancement
  Disciplr-Org/Disciplr-backend#1715 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Emit vault_id and consistent Symbol topics in every accountability_vault event

  area-contractspriority:highStellar Wavetype-enhancement
  Disciplr-Org/Disciplr-backend#1714 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Reject self-verifying and duplicate verifier sets in create_vault

  area-contractspriority:highStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1713 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Stop creators from escaping slash_on_miss by calling withdraw on an Active vault

  area-contractspriority:highStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1712 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Run contract tests, clippy and wasm size checks in CI and wire orphaned test code into the workspace

  area-contractspriority:mediumStellar Wavetype-testing
  Disciplr-Org/Disciplr-backend#1711 · Filter by author 1nonlypiece opened on Oct 18, 2026
  4

  

• [contracts] Implement the documented admin init and token allowlist for create_vault

  area-contractspriority:mediumStellar Wavetype-feature
  Disciplr-Org/Disciplr-backend#1710 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Separate the vault guardian from the creator and make pause block milestone claims

  area-contractspriority:mediumStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1709 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Settle funds when admin_resolve ends a dispute as Completed or Failed

  area-contractspriority:mediumStellar Wavetype-enhancement
  Disciplr-Org/Disciplr-backend#1708 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3

  

• [contracts] Replace the unauthenticated global dispute window with a per-vault, bounded setting

  area-contractspriority:highStellar Wavetype-security
  Disciplr-Org/Disciplr-backend#1707 · Filter by author 1nonlypiece opened on Oct 18, 2026
  3