Issues

• Add an OpenAPI spec and the missing GET /epochs listing / pagination

  MeritPay/MeritPay-Backend#17 · Filter by author Maxwell316 opened on Sep 6, 2026

• No linter, formatter, pinned Node version, or typecheck script

  MeritPay/MeritPay-Backend#16 · Filter by author Maxwell316 opened on Sep 6, 2026

• Production Postgres path is undocumented and unsupported by the committed migrations

  MeritPay/MeritPay-Backend#15 · Filter by author Maxwell316 opened on Sep 6, 2026

• Replace console.* with structured logging and request correlation IDs

  MeritPay/MeritPay-Backend#14 · Filter by author Maxwell316 opened on Sep 6, 2026

• No graceful shutdown and /health does not check database connectivity

  MeritPay/MeritPay-Backend#13 · Filter by author Maxwell316 opened on Sep 6, 2026

• Missing HTTP hardening: security headers, rate limiting, body-size limit, prod CORS

  MeritPay/MeritPay-Backend#12 · Filter by author Maxwell316 opened on Sep 6, 2026

• Per-employee claim amounts and names are exposed without access control

  MeritPay/MeritPay-Backend#11 · Filter by author Maxwell316 opened on Sep 6, 2026

• No authentication: employerWallet is an unverified client-supplied identifier

  MeritPay/MeritPay-Backend#10 · Filter by author Maxwell316 opened on Sep 6, 2026

• ClaimEntry has no @@unique([epochId, employeeId]) constraint

  MeritPay/MeritPay-Backend#9 · Filter by author Maxwell316 opened on Sep 6, 2026

• Numeric-string fields accept arbitrary strings

  MeritPay/MeritPay-Backend#8 · Filter by author Maxwell316 opened on Sep 6, 2026
  3

  

• proof and publicSignals are not structurally validated

  MeritPay/MeritPay-Backend#7 · Filter by author Maxwell316 opened on Sep 6, 2026
  3

  

• Malformed JSON and oversized bodies return 500 instead of 400/413

  MeritPay/MeritPay-Backend#6 · Filter by author Maxwell316 opened on Sep 6, 2026
  2

  

• No automated test suite or CI pipeline

  MeritPay/MeritPay-Backend#5 · Filter by author Maxwell316 opened on Sep 6, 2026