Issues

• graceful-shutdown.spec.ts asserts nothing about graceful shutdown despite its name and comments

  backendbugdifficulty: easypriority: lowtesting
  trustflow-protocol/trustflow-backend#793 · Filter by author meshackyaro opened on Oct 19, 2026

• OutboxRelayService.runOnce() perpetually re-spawns a new outbox event for every event it relays, including its own spawned clones

  backendbugdifficulty: hardpriority: highreliability
  trustflow-protocol/trustflow-backend#792 · Filter by author meshackyaro opened on Oct 19, 2026

• Any authenticated user can read and overwrite another user's notification preferences

  backendbugdifficulty: mediumpriority: highsecurity
  trustflow-protocol/trustflow-backend#791 · Filter by author meshackyaro opened on Oct 19, 2026

• GigExpiryWorkerService.runOnce() never applies GIG_EXPIRY_SWEEP_MAX_GIGS, so the per-tick cap is documented and tested but not enforced

  backendbugdifficulty: mediumpriority: mediumreliability
  trustflow-protocol/trustflow-backend#790 · Filter by author meshackyaro opened on Oct 19, 2026

• gig-expiry-worker.service.spec.ts fails to compile: makeGig() is missing the now-required Gig.version field

  backendbugdifficulty: easygood first issuepriority: hightesting
  trustflow-protocol/trustflow-backend#789 · Filter by author meshackyaro opened on Oct 19, 2026

• rate-limit.guard.ts does not compile: malformed/duplicate interface declarations, a nonexistent import, and a duplicate jwtService member

  backendbugdifficulty: mediumpriority: highsecurity
  trustflow-protocol/trustflow-backend#788 · Filter by author meshackyaro opened on Oct 19, 2026

• Webhook subscriptions created via POST /webhooks/subscriptions are never actually delivered to

  backendbugdifficulty: hardpriority: highreliability
  trustflow-protocol/trustflow-backend#787 · Filter by author meshackyaro opened on Oct 19, 2026

• escrow.entity.ts defines a dead, parallel EscrowEntity/EscrowStatus that duplicates and conflicts with the real Escrow model

  backendbugcoredifficulty: easypriority: low
  trustflow-protocol/trustflow-backend#786 · Filter by author meshackyaro opened on Oct 19, 2026

• PlatformBalanceService's shared alert cooldown lets a CRITICAL alert be silenced by a prior WARNING

  backendbugdifficulty: mediumpriority: mediumreliability
  trustflow-protocol/trustflow-backend#785 · Filter by author meshackyaro opened on Oct 19, 2026

• AuditExportService.exportLogs() always returns an empty checksum to the caller

  backendbugdifficulty: easypriority: low
  trustflow-protocol/trustflow-backend#784 · Filter by author meshackyaro opened on Oct 19, 2026

• AuditService.exportLogs() is a fully-built, unused duplicate of AuditExportService.exportLogs()

  backendbugdifficulty: mediumpriority: low
  trustflow-protocol/trustflow-backend#782 · Filter by author meshackyaro opened on Oct 19, 2026

• SorobanEventIndexerService has no overlap guard and its cursor can move backward on concurrent polls

  backendbugdifficulty: mediumpriority: mediumreliability
  trustflow-protocol/trustflow-backend#783 · Filter by author meshackyaro opened on Oct 19, 2026

• GET /escrows/:id/release/transaction builds a release XDR for any sourceAccount regardless of escrow status or beneficiary

  backendbugdifficulty: mediumpriority: mediumsecurity
  trustflow-protocol/trustflow-backend#781 · Filter by author meshackyaro opened on Oct 19, 2026

• All four GraphQL DataLoaders are unimplemented stubs: milestones, deliverables, jurorVotes and profiles always resolve empty

  backendbugcoredifficulty: mediumpriority: high
  trustflow-protocol/trustflow-backend#780 · Filter by author meshackyaro opened on Oct 19, 2026

• EscrowAnalyticsService.getPaginatedEscrowAnalytics() builds escrowEntities but never returns them

  backendbugdifficulty: mediumoptimizationpriority: low
  trustflow-protocol/trustflow-backend#779 · Filter by author meshackyaro opened on Oct 19, 2026

• EventIngestionService.retryFailedEvents() never actually retries because it skips clearing the stale failed record first

  backendbugdifficulty: mediumpriority: highreliability
  trustflow-protocol/trustflow-backend#778 · Filter by author meshackyaro opened on Oct 19, 2026

• AuthService.validateToken() has unreachable dead code after its try/catch block

  backendbugdifficulty: easypriority: low
  trustflow-protocol/trustflow-backend#777 · Filter by author meshackyaro opened on Oct 19, 2026

• reputation.integration.spec.ts calls EscrowController.raiseDispute(), a method that was moved to EscrowDisputeController

  backendbugcoredifficulty: easypriority: mediumStellar Wavetesting
  trustflow-protocol/trustflow-backend#762 · Filter by author meshackyaro opened on Oct 16, 2026
  3

  

• A stray closing brace in escrow-reconciliation.service.spec.ts breaks parsing for the rest of the file

  backendbugcoredifficulty: easygood first issuepriority: highStellar Wavetesting
  trustflow-protocol/trustflow-backend#760 · Filter by author meshackyaro opened on Oct 16, 2026
  3

  

• gig.controller.spec.ts fails to compile: create/accept/cancel/update calls are missing the now-required request argument

  backendbugcoredifficulty: easygood first issuepriority: mediumStellar Wavetesting
  trustflow-protocol/trustflow-backend#759 · Filter by author meshackyaro opened on Oct 16, 2026
  3

  

• EventDedupService's bounded local-cache eviction path has no test coverage

  backenddifficulty: easyenhancementgood first issuepriority: lowStellar Wavetesting
  trustflow-protocol/trustflow-backend#732 · Filter by author meshackyaro opened on Oct 16, 2026
  2

• RpcStatusController and PlatformBalanceService have zero test coverage

  backenddifficulty: easyenhancementgood first issuepriority: lowStellar Wavetesting
  trustflow-protocol/trustflow-backend#731 · Filter by author meshackyaro opened on Oct 16, 2026
  4

  

• scrubEvent()'s tags/extra/contexts/user.ip_address/query_string/exception redaction paths have no test coverage beyond request/breadcrumbs

  backenddifficulty: easyenhancementgood first issuepriority: mediumsecurityStellar Wavetesting
  trustflow-protocol/trustflow-backend#707 · Filter by author meshackyaro opened on Oct 15, 2026
  11

  

• MigrationStateStore's production Redis-required startup guard has no test coverage

  backenddatabasedifficulty: easyenhancementgood first issuepriority: mediumreliabilityStellar Wavetesting
  trustflow-protocol/trustflow-backend#705 · Filter by author meshackyaro opened on Oct 15, 2026
  18

  

• The only registered schema migration is an in-memory demo fixture that auto-runs on every boot and never touches real gig data

  backendbugdatabasedifficulty: hardhelp wantedpriority: highreliabilityStellar Wave
  trustflow-protocol/trustflow-backend#703 · Filter by author meshackyaro opened on Oct 15, 2026
  12