Issues

• Scheduled E2E test failing on main

  e2e-failure
  Lumen-Scribe/Lumenqraph#679 · Filter by author github-actions opened on Oct 19, 2026
  1

• Only the indexer understands --help/--version, so docker.yml's binary smoke tests can't pass for the API, webhooks and MCP

  bugci-cdinfra
  Lumen-Scribe/Lumenqraph#651 · Filter by author Lost-Z opened on Oct 15, 2026

• Add a CODEOWNERS file so changes to migrations, workflows and security-sensitive code need maintainer review

  ci-cdsecurity
  Lumen-Scribe/Lumenqraph#650 · Filter by author Lost-Z opened on Oct 15, 2026

• Random-key floods evict valid API keys from the LRU key cache

  apiperformancesecurity
  Lumen-Scribe/Lumenqraph#649 · Filter by author Lost-Z opened on Oct 15, 2026

• Event since/until filters cast to timezone-less timestamp, so results shift by the database's TimeZone setting

  apibug
  Lumen-Scribe/Lumenqraph#648 · Filter by author Lost-Z opened on Oct 15, 2026

• API SpecCache makes a DB round-trip on every lookup, and evicts by clearing the whole map

  apiperformance
  Lumen-Scribe/Lumenqraph#647 · Filter by author Lost-Z opened on Oct 15, 2026

• check_sensitive_logging.py matches nothing in the real code: it only looks for tracing::-prefixed macros

  ci-cdsecuritytech-debt
  Lumen-Scribe/Lumenqraph#645 · Filter by author Lost-Z opened on Oct 15, 2026

• WEBHOOK_ENCRYPTION_KEY is only checked for being non-empty, so the .env.example placeholder is accepted as a real key

  securitywebhooks
  Lumen-Scribe/Lumenqraph#644 · Filter by author Lost-Z opened on Oct 15, 2026

• gen_api_key.sh interpolates its arguments straight into SQL and can't set the newer key columns

  good first issuesecurity
  Lumen-Scribe/Lumenqraph#643 · Filter by author Lost-Z opened on Oct 15, 2026

• The sample prometheus.yml scrapes only the API, never the indexer or webhooks metrics endpoints

  documentationobservability
  Lumen-Scribe/Lumenqraph#642 · Filter by author Lost-Z opened on Oct 15, 2026

• docs/WEBHOOKS.md still documents the legacy sha256= signature over the body, not the current t=…,v1=… scheme

  documentationsecuritywebhooks
  Lumen-Scribe/Lumenqraph#641 · Filter by author Lost-Z opened on Oct 15, 2026

• Broken links: SECURITY.md → SECURITY_CREDITS.md, and fly.toml → docs/DEPLOY.md

  documentationgood first issue
  Lumen-Scribe/Lumenqraph#640 · Filter by author Lost-Z opened on Oct 15, 2026

• docs/CONFIGURATION.md is missing about 37 environment variables the code reads

  documentation
  Lumen-Scribe/Lumenqraph#639 · Filter by author Lost-Z opened on Oct 15, 2026

• The explorer stores the API key in localStorage in plaintext

  security
  Lumen-Scribe/Lumenqraph#638 · Filter by author Lost-Z opened on Oct 15, 2026

• The explorer build script regenerates index.html from a template string, so there are two sources of truth

  refactortech-debt
  Lumen-Scribe/Lumenqraph#637 · Filter by author Lost-Z opened on Oct 15, 2026

• The explorer treats paginated API responses as arrays, so the contract list, events and transfers tabs break

  bug
  Lumen-Scribe/Lumenqraph#636 · Filter by author Lost-Z opened on Oct 15, 2026

• Explorer app.js isn't committed or built in the Docker image, so the bundled explorer can't load its script

  buginfra
  Lumen-Scribe/Lumenqraph#635 · Filter by author Lost-Z opened on Oct 15, 2026

• Python SDK ignores Retry-After, and its async client's retries can't be cancelled

  bugsdk
  Lumen-Scribe/Lumenqraph#634 · Filter by author Lost-Z opened on Oct 15, 2026

• The Python SDK declares httpx and pydantic as dependencies but uses neither

  performancesdkStellar Wave
  Lumen-Scribe/Lumenqraph#633 · Filter by author Lost-Z opened on Oct 15, 2026
  3

  

• Python packaging: metadata duplicated between setup.py and pyproject.toml, and project URLs point to a repository that doesn't exist

  good first issuesdkStellar Wave
  Lumen-Scribe/Lumenqraph#632 · Filter by author Lost-Z opened on Oct 15, 2026
  4

  

• The Python SDK can't be built: pyproject.toml references a LICENSE file that doesn't exist in sdk/python

  buggood first issuesdkStellar Wave
  Lumen-Scribe/Lumenqraph#631 · Filter by author Lost-Z opened on Oct 15, 2026
  3

  

• Both SDKs retry non-idempotent requests (POST /webhooks, rotate-secret, redrive) on network errors and 5xx

  bugsdkStellar Wave
  Lumen-Scribe/Lumenqraph#630 · Filter by author Lost-Z opened on Oct 15, 2026
  3

  

• Both SDKs call GET /transfers when no contract is given, but that route doesn't exist

  bugsdkStellar Wave
  Lumen-Scribe/Lumenqraph#629 · Filter by author Lost-Z opened on Oct 15, 2026
  3

  

• SDK webhook verifiers accept the legacy sha256= format, which bypasses timestamp replay protection

  sdksecurityStellar Wavewebhooks
  Lumen-Scribe/Lumenqraph#628 · Filter by author Lost-Z opened on Oct 15, 2026
  3

  

• MCP tool results include raw base64 XDR alongside decoded and enriched copies, bloating agent context

  enhancementmcpperformanceStellar Wave
  Lumen-Scribe/Lumenqraph#627 · Filter by author Lost-Z opened on Oct 15, 2026
  2