Issues

• Production build is missing JSON assets: tsc does not copy contractErrors.json (or schemas/) into dist, so the image crashes at import

  bughighinfrastructure
  Heliobond/backend#932 · Filter by author AbelOsaretin opened on Oct 17, 2026

• scoreEvents.emit is called without a try/catch, so a throwing listener propagates into the score-update cron

  buglow
  Heliobond/backend#931 · Filter by author AbelOsaretin opened on Oct 17, 2026

• Comparison, ranking and dashboard endpoints synthesize metrics for nonexistent project ids without validation

  bugmedium
  Heliobond/backend#930 · Filter by author AbelOsaretin opened on Oct 17, 2026

• WebSocket servers are created without maxPayload, accepting up to the ws default of 100 MiB per message

  bugmediumsecurity
  Heliobond/backend#929 · Filter by author AbelOsaretin opened on Oct 17, 2026

• duplicate-detection activeLocks never reaps locks whose project is never touched again

  buglow
  Heliobond/backend#928 · Filter by author AbelOsaretin opened on Oct 17, 2026

• Several test suites rely on real wall-clock sleeps and are flake-prone on slow CI runners

  buglowtesting
  Heliobond/backend#927 · Filter by author AbelOsaretin opened on Oct 17, 2026

• Admin audit log store is an unbounded in-memory array that never evicts

  bugmedium
  Heliobond/backend#926 · Filter by author AbelOsaretin opened on Oct 17, 2026

• OpenAPI Error schema documents the flat legacy shape { error: string } instead of the nested { error: { code, message } } contract

  bugdocumentationmedium
  Heliobond/backend#925 · Filter by author AbelOsaretin opened on Oct 17, 2026

• Content-Security-Policy is completely disabled for /docs, leaving Swagger UI without CSP

  bugmediumsecurity
  Heliobond/backend#924 · Filter by author AbelOsaretin opened on Oct 17, 2026

• gRPC error handler leaks internal error.message to clients in status details

  bugmediumsecurity
  Heliobond/backend#923 · Filter by author AbelOsaretin opened on Oct 17, 2026

• GraphQL endpoint has no query depth or complexity limiting, enabling trivial resource exhaustion

  bugmediumsecurity
  Heliobond/backend#922 · Filter by author AbelOsaretin opened on Oct 17, 2026

• multichain submitToChain fabricates fake transaction hashes for EVM chains even when RPC and contract are configured

  bughigh
  Heliobond/backend#921 · Filter by author AbelOsaretin opened on Oct 17, 2026

• computeTrend still uses only the first and last history entries, ignoring intermediate data

  bugmedium
  Heliobond/backend#920 · Filter by author AbelOsaretin opened on Oct 17, 2026

• GraphiQL playground loads React and GraphiQL from unpkg.com without SRI integrity hashes

  bughighsecurity
  Heliobond/backend#919 · Filter by author AbelOsaretin opened on Oct 17, 2026

• Benchmarking route: not-found returns 400, POST accepts unvalidated metric/thresholds/id, and any consumer key mutates global definitions

  bugmedium
  Heliobond/backend#911 · Filter by author AbelOsaretin opened on Oct 16, 2026

• requestTimeout leaks timers on client disconnect and the 408 path does not stop the downstream handler

  buglow
  Heliobond/backend#910 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Anomaly admin PUT /config returns 500 instead of 400 on bad input and accepts unbounded window sizes

  bugmedium
  Heliobond/backend#909 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Stray working files committed to the repo root and duplicated Unreleased sections in CHANGELOG

  bugdocumentationlow
  Heliobond/backend#908 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Scheduled Security Headers Audit job can never fail: it prints checkboxes but never exits non-zero

  buginfrastructurelow
  Heliobond/backend#907 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Local-stack compose ships a guessable admin key, runs deployer as root, and pulls mutable :latest images

  buglowsecurity
  Heliobond/backend#906 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Security-critical modules with thin or no direct tests: vault RPC/XDR paths and secrets provider backends

  buglowtesting
  Heliobond/backend#905 · Filter by author AbelOsaretin opened on Oct 16, 2026

• api-client publish pipeline is unwired: nothing publishes the package and its version never tracks backend releases

  bugmedium
  Heliobond/backend#904 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Dependency-pinning policy (ADR-004 / SECURITY.md) is unenforced for GitHub Actions, base images, and Bun

  bugmediumsecurity
  Heliobond/backend#903 · Filter by author AbelOsaretin opened on Oct 16, 2026

• README contradicts CI and package.json on the audit gate, dependency pinning policy, and Stellar SDK version

  bugdocumentationmedium
  Heliobond/backend#902 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Documented rollback procedure cannot roll back to an earlier image: deploy.yml always rebuilds from main HEAD

  bugdocumentationmedium
  Heliobond/backend#901 · Filter by author AbelOsaretin opened on Oct 16, 2026