Issues

Price and ownership routes write DB state from the request body, not the confirmed transaction

SynapsVault/backend#74 · opened

on Oct 13, 2026

3

Request timeout returns 503 but the publish keeps running

SynapsVault/backend#73 · opened

on Oct 13, 2026

3

Idempotency-Key header is not validated

SynapsVault/backend#72 · opened

on Oct 13, 2026

2

Idempotency records are per-process, so retries on another replica can duplicate resources

SynapsVault/backend#71 · opened

on Oct 13, 2026

2

Idempotency 'in progress' marker lasts 24 hours after a crash

SynapsVault/backend#70 · opened

on Oct 13, 2026

2

Redis rate-limit store can fail at boot and leave an unhandled rejection

SynapsVault/backend#69 · opened

on Oct 13, 2026

3

Built registry-client dist files are committed despite .gitignore

SynapsVault/backend#68 · opened

on Oct 13, 2026

2

e2e script prints the test wallet secret key to stdout

SynapsVault/backend#67 · opened

on Oct 13, 2026

3

Catalog seed workflow sets ALLOWED_ORIGINS to '*' in production mode

SynapsVault/backend#66 · opened

on Oct 13, 2026

2

CORS rejected-origin tracking grows without bound

SynapsVault/backend#65 · opened

on Oct 13, 2026

3

CORS does not allow PATCH, so browser calls to PATCH routes fail preflight

SynapsVault/backend#64 · opened

on Oct 13, 2026

3

Production defaults for WEB_APP_URL and BASE_URL point at localhost

SynapsVault/backend#63 · opened

on Oct 13, 2026

2

text/* uploads accept arbitrary bytes and are served with the declared type

SynapsVault/backend#62 · opened

on Oct 13, 2026

2

Content-Disposition filename is not escaped for quotes and semicolons

SynapsVault/backend#61 · opened

on Oct 13, 2026

2

Stellar addresses are not validated on publish, publisher registration and ownership transfer

SynapsVault/backend#60 · opened

on Oct 13, 2026

3

Price fields are not validated at publish or set_price, so bad prices become 500s

SynapsVault/backend#59 · opened

on Oct 13, 2026

2

externalUrl accepts any URL scheme, including javascript: and data:

SynapsVault/backend#58 · opened

on Oct 13, 2026

3

docker-compose publishes Postgres on all interfaces with default credentials

SynapsVault/backend#57 · opened

on Oct 13, 2026

2

Postgres connection disables certificate verification outside localhost

SynapsVault/backend#56 · opened

on Oct 13, 2026

2

CSP script-src 'unsafe-inline' applies to every API response

SynapsVault/backend#55 · opened

on Oct 13, 2026

4

Swagger UI is served in every environment, and its CDN assets are unpinned

SynapsVault/backend#54 · opened

on Oct 13, 2026

Process keeps running after an uncaughtException

SynapsVault/backend#53 · opened

on Oct 13, 2026

1

/debug/db exposes schema and row counts outside production

SynapsVault/backend#52 · opened

on Oct 13, 2026

Admin delisting is undone by re-verification and by chain sync

SynapsVault/backend#51 · opened

on Oct 13, 2026

1

Admin delist leaves no audit record of who acted or why

SynapsVault/backend#50 · opened

on Oct 13, 2026

Navigation Menu

Repository navigation

Issues

Price and ownership routes write DB state from the request body, not the confirmed transaction

Request timeout returns 503 but the publish keeps running

Idempotency-Key header is not validated

Idempotency records are per-process, so retries on another replica can duplicate resources

Idempotency 'in progress' marker lasts 24 hours after a crash

Redis rate-limit store can fail at boot and leave an unhandled rejection

Built registry-client dist files are committed despite .gitignore

e2e script prints the test wallet secret key to stdout

Catalog seed workflow sets ALLOWED_ORIGINS to '*' in production mode

CORS rejected-origin tracking grows without bound

CORS does not allow PATCH, so browser calls to PATCH routes fail preflight

Production defaults for WEB_APP_URL and BASE_URL point at localhost

text/* uploads accept arbitrary bytes and are served with the declared type

Content-Disposition filename is not escaped for quotes and semicolons

Stellar addresses are not validated on publish, publisher registration and ownership transfer

Price fields are not validated at publish or set_price, so bad prices become 500s

externalUrl accepts any URL scheme, including javascript: and data:

docker-compose publishes Postgres on all interfaces with default credentials

Postgres connection disables certificate verification outside localhost

CSP script-src 'unsafe-inline' applies to every API response

Swagger UI is served in every environment, and its CDN assets are unpinned

Process keeps running after an uncaughtException

/debug/db exposes schema and row counts outside production

Admin delisting is undone by re-verification and by chain sync

Admin delist leaves no audit record of who acted or why