Issues

The Caddy reverse-proxy config overwrites the app's `Referrer-Policy: no-referrer` with a weaker policy

StellarGateLabs/StellarGate#902 · opened

on Oct 14, 2026

4

Remove stale `#[allow(dead_code)]` attributes whose comments say the code is unused when it is used

StellarGateLabs/StellarGate#901 · opened

on Oct 14, 2026

4

Dependabot doesn't cover the npm lockfile in `e2e/`, so Playwright and its transitive dependencies never get updates

StellarGateLabs/StellarGate#900 · opened

on Oct 14, 2026

3

Harden CI workflows: no `permissions` block, no `concurrency`, actions on mutable tags, Node 20 (EOL), and uncached tool installs

StellarGateLabs/StellarGate#899 · opened

on Oct 14, 2026

4

Shutdown can overrun the container's stop grace period: workers are signalled only after HTTP has drained, and the HTTP drain has no deadline

StellarGateLabs/StellarGate#898 · opened

on Oct 14, 2026

4

Nothing prevents two StellarGate instances from running against the same database, which duplicates webhooks

StellarGateLabs/StellarGate#897 · opened

on Oct 14, 2026

3

`GET /v1/payments/summary` returns only counts per status: add per-asset amounts and a date range

StellarGateLabs/StellarGate#896 · opened

on Oct 14, 2026

3

API key `label` length is checked in bytes while the error message says characters, and control characters are accepted

StellarGateLabs/StellarGate#895 · opened

on Oct 14, 2026

3

Audit logging is inconsistent across admin actions: `api_key.issue` omits `source_ip`/`request_id`, and key listing isn't audited

StellarGateLabs/StellarGate#894 · opened

on Oct 14, 2026

3

There is no merchant lifecycle: merchants can't be named, listed, inspected, suspended or deleted

StellarGateLabs/StellarGate#893 · opened

on Oct 14, 2026

3

Support a merchant-level default webhook URL instead of requiring `webhook_url` on every intent

StellarGateLabs/StellarGate#892 · opened

on Oct 14, 2026

3

Allow a per-intent expiry (`expires_in`) instead of a single global `PAYMENT_TTL_SECS`

StellarGateLabs/StellarGate#891 · opened

on Oct 14, 2026

3

Payment intents can't carry merchant metadata (order ID, customer reference, description)

StellarGateLabs/StellarGate#890 · opened

on Oct 14, 2026

3

SSRF guard misses several IPv6 ranges that reach internal or IPv4 hosts (NAT64, 6to4, Teredo, IPv4-compatible, site-local)

StellarGateLabs/StellarGate#889 · opened

on Oct 14, 2026

3

`/ready` is public, exempt from rate limiting, makes an uncached Horizon request per call, and returns raw error text

StellarGateLabs/StellarGate#888 · opened

on Oct 14, 2026

4

Bearer-token parsing is copy-pasted three times and only accepts the exact case `Bearer`

StellarGateLabs/StellarGate#887 · opened

on Oct 14, 2026

3

Failed `X-Admin-Secret` attempts are neither logged nor counted, and admin key listing gets the 5× read quota, so brute force goes unnoticed

StellarGateLabs/StellarGate#886 · opened

on Oct 14, 2026

3

Expiry sweeper and webhook redrive load unbounded result sets and process them serially, so a backlog after downtime stalls them

StellarGateLabs/StellarGate#885 · opened

on Oct 14, 2026

5

Manual redelivery consumes the automatic retry budget again (regression of #235), and has no audit log, no metrics, and can overwrite a `delivered` record

StellarGateLabs/StellarGate#884 · opened

on Oct 14, 2026

3

Webhook delivery rows record only `status` and `attempts`, not the receiver's response, so a failed delivery can't be diagnosed

StellarGateLabs/StellarGate#883 · opened

on Oct 14, 2026

3

Inline webhook retries reuse the first attempt's timestamp and signature, so late retries fall outside the receiver's replay window

StellarGateLabs/StellarGate#882 · opened

on Oct 14, 2026

4

Webhook events have no unique event ID, and the docs tell receivers to deduplicate by `payment_id`, which drops real follow-up events

StellarGateLabs/StellarGate#881 · opened

on Oct 14, 2026

3

`stellargate_http_` and `stellargate_payment` metrics are exported but never recorded, so they are always zero

StellarGateLabs/StellarGate#880 · opened

on Oct 14, 2026

4

`POST /v1/payments` no longer rejects assets without a gateway trustline, although `openapi.yaml` documents `trustline_missing`

StellarGateLabs/StellarGate#879 · opened

on Oct 14, 2026

3

`POST /v1/payments` mints intents with `destination_address: "UNCONFIGURED"` when no gateway account is set

StellarGateLabs/StellarGate#878 · opened

on Oct 14, 2026

3

Navigation Menu

Repository navigation

Issues

The Caddy reverse-proxy config overwrites the app's `Referrer-Policy: no-referrer` with a weaker policy

Remove stale `#[allow(dead_code)]` attributes whose comments say the code is unused when it is used

Dependabot doesn't cover the npm lockfile in `e2e/`, so Playwright and its transitive dependencies never get updates

Harden CI workflows: no `permissions` block, no `concurrency`, actions on mutable tags, Node 20 (EOL), and uncached tool installs

Shutdown can overrun the container's stop grace period: workers are signalled only after HTTP has drained, and the HTTP drain has no deadline

Nothing prevents two StellarGate instances from running against the same database, which duplicates webhooks

`GET /v1/payments/summary` returns only counts per status: add per-asset amounts and a date range

API key `label` length is checked in bytes while the error message says characters, and control characters are accepted

Audit logging is inconsistent across admin actions: `api_key.issue` omits `source_ip`/`request_id`, and key listing isn't audited

There is no merchant lifecycle: merchants can't be named, listed, inspected, suspended or deleted

Support a merchant-level default webhook URL instead of requiring `webhook_url` on every intent

Allow a per-intent expiry (`expires_in`) instead of a single global `PAYMENT_TTL_SECS`

Payment intents can't carry merchant metadata (order ID, customer reference, description)

SSRF guard misses several IPv6 ranges that reach internal or IPv4 hosts (NAT64, 6to4, Teredo, IPv4-compatible, site-local)

`/ready` is public, exempt from rate limiting, makes an uncached Horizon request per call, and returns raw error text

Bearer-token parsing is copy-pasted three times and only accepts the exact case `Bearer`

Failed `X-Admin-Secret` attempts are neither logged nor counted, and admin key listing gets the 5× read quota, so brute force goes unnoticed

Expiry sweeper and webhook redrive load unbounded result sets and process them serially, so a backlog after downtime stalls them

Manual redelivery consumes the automatic retry budget again (regression of #235), and has no audit log, no metrics, and can overwrite a `delivered` record

Webhook delivery rows record only `status` and `attempts`, not the receiver's response, so a failed delivery can't be diagnosed

Inline webhook retries reuse the first attempt's timestamp and signature, so late retries fall outside the receiver's replay window

Webhook events have no unique event ID, and the docs tell receivers to deduplicate by `payment_id`, which drops real follow-up events

`stellargate_http_` and `stellargate_payment` metrics are exported but never recorded, so they are always zero

`POST /v1/payments` no longer rejects assets without a gateway trustline, although `openapi.yaml` documents `trustline_missing`

`POST /v1/payments` mints intents with `destination_address: "UNCONFIGURED"` when no gateway account is set