-
Notifications
You must be signed in to change notification settings - Fork 49
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
[weekly-audit] Security / licence findings — 2026-09-07
securityImported from local backlog 2026-07-16Imported from local backlog 2026-07-16Status: Open.#254 In NovaCoreLabs1/NovaLabs;[weekly-audit] Security / licence findings — 2026-08-31
securityImported from local backlog 2026-07-16Imported from local backlog 2026-07-16Status: Open.#252 In NovaCoreLabs1/NovaLabs;Paystack webhook handler races on payment status: duplicate escrows and FAILED-after-SUCCESS states
area:paymentsImported from local backlog 2026-07-16Imported from local backlog 2026-07-16bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardpriority:highImported from local backlog 2026-07-16Imported from local backlog 2026-07-16Third CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#236 In NovaCoreLabs1/NovaLabs;Login redirect parameter is an open redirect: router.push trusts unvalidated query input
area:frontendImported from local backlog 2026-07-16Imported from local backlog 2026-07-16area:securityImported from local backlog 2026-07-16Imported from local backlog 2026-07-16bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardpriority:highImported from local backlog 2026-07-16Imported from local backlog 2026-07-16Third CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#234 In NovaCoreLabs1/NovaLabs;No server-side logout: refresh tokens stay valid for 7 days after the user logs out
area:authImported from local backlog 2026-07-16Imported from local backlog 2026-07-16area:securityImported from local backlog 2026-07-16Imported from local backlog 2026-07-16bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardpriority:highImported from local backlog 2026-07-16Imported from local backlog 2026-07-16Third CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#235 In NovaCoreLabs1/NovaLabs;Frontend token refresh is broken and never invoked: sessions end at the 15-minute access-token expiry
area:authImported from local backlog 2026-07-16Imported from local backlog 2026-07-16area:frontendImported from local backlog 2026-07-16Imported from local backlog 2026-07-16bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardpriority:highImported from local backlog 2026-07-16Imported from local backlog 2026-07-16Third CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#233 In NovaCoreLabs1/NovaLabs;Password reset and email verification use a 4-digit OTP with no per-account attempt limiting
area:authImported from local backlog 2026-07-16Imported from local backlog 2026-07-16area:securityImported from local backlog 2026-07-16Imported from local backlog 2026-07-16bugSomething isn't workingSomething isn't workingGrantFox OSSIssue tracked in GrantFox OSSIssue tracked in GrantFox OSSMaybe RewardedIssue may be eligible for a GrantFox rewardIssue may be eligible for a GrantFox rewardpriority:criticalImported from local backlog 2026-07-16Imported from local backlog 2026-07-16Third CampaignCampaign: Third CampaignCampaign: Third CampaignStatus: Open.#232 In NovaCoreLabs1/NovaLabs;