MRWK bounty: useful bug reports and small fixes, round 5

[ramimbo]

MRWK Bounty

Reward: 50 MRWK per accepted award
Max awards: 20

Work Needed

Submit useful distinct non-security bug reports, small focused fixes, or regression tests with concrete evidence. This continues #292 after its award slots were used.

Useful accepted work can include:

• A small bug fix with a focused regression test.
• A concrete public bug report with expected behavior, observed behavior, and reproduction steps.
• A narrow validation, docs, or error-handling fix that preserves existing behavior and tests.
• A regression test that captures a real edge case and explains why it matters.

Acceptance Criteria

• Link the PR or report to this issue.
• Keep the work focused and evidence-backed.
• Add or update tests when behavior changes.
• Existing checks pass for code changes.
• One award per distinct useful report or accepted fix. Duplicate, vague, misleading, no-value, broad rewrite, unrelated, style-only, or private-security-detail submissions do not qualify.
• Private security findings must stay private until maintainers approve disclosure.
• Do not post private keys, seed material, secrets, private vulnerability details, deployment credentials, or price claims.

How To Submit

Open a focused PR or comment with the required evidence. A maintainer must apply mrwk:accepted or record an admin payout before payment.

[ramimbo]

Reserved on MergeWork: https://mrwk.ltclab.site/bounties/66

[prettyboyvic]

/claim #436

Focused Bounty #406 small fix: validate_public_url now rejects malformed DNS host labels such as api..example, bad_host.example, -bad.example, and bad-.example, with regression coverage and without changing the existing non-global IP rejection behavior.

Validation:

• ./.venv/Scripts/python.exe -m pytest tests/test_security_url_validation.py tests/test_security.py::test_public_url_or_none_omits_control_character_urls -q -> 6 passed
• ./.venv/Scripts/python.exe -m ruff check app/ledger/service.py tests/test_security_url_validation.py -> passed
• ./.venv/Scripts/python.exe -m ruff format --check app/ledger/service.py tests/test_security_url_validation.py -> passed
• git diff --check -> clean

[CharlieLZ]

/claim #438

Focused Bounty #406 small fix: submission quality and PR queue health checks now recognize /claim #N as a bounty reference, matching the claim format contributors already use. This prevents false missing-reference warnings without changing payout or URL validation behavior.

Validation:

• ./.venv/bin/python -m pytest -> 404 passed
• ./.venv/bin/python -m ruff format --check . -> 78 files already formatted
• ./.venv/bin/python -m ruff check . -> All checks passed
• ./.venv/bin/python -m mypy app -> Success: no issues found in 29 source files
• git diff --check HEAD~1 HEAD -> clean

[gamechangsu]

/claim #441

Focused Bounty #406 small fix: public REST bounty listing now honors limit, and /api/v1/bounties/summary summarizes the same limited result set. Before the fix, live GET https://api.mrwk.ltclab.site/api/v1/bounties?status=open&limit=1 returned 7 open rows instead of 1, and the summary endpoint also ignored limit.

Validation:

• Added regression test first and confirmed it failed before the route change: ignored limit and unvalidated out-of-range values.
• .\.venv\Scripts\python.exe -m pytest tests/test_bounty_api_routes.py::test_bounty_api_limit_caps_filtered_rows tests/test_bounty_api_routes.py::test_bounty_api_limit_rejects_out_of_range_values -q -> 2 passed
• .\.venv\Scripts\python.exe -m pytest tests/test_bounty_api_routes.py tests/test_bounty_api.py tests/test_bounty_pages.py tests/test_mcp_tools.py -q -> 31 passed
• .\.venv\Scripts\python.exe -m pytest tests/test_api_mcp.py::test_mcp_list_bounties_filters_status_query_and_limit tests/test_api_mcp.py::test_mcp_list_bounties_rejects_invalid_filters -q -> 6 passed
• .\.venv\Scripts\python.exe -m ruff check app\bounty_api.py tests\test_bounty_api_routes.py -> passed
• .\.venv\Scripts\python.exe -m ruff format --check app\bounty_api.py tests\test_bounty_api_routes.py -> passed
• .\.venv\Scripts\python.exe -m mypy app -> passed
• git diff --check -> clean

[ramimbo]

Accepted and paid in the 2026-05-26 maintainer batch. Bounty #66 remains open with 16 slots.

Source	Amount	Recipient	Proof
PR #436	50 MRWK	mrwk1fb1437aec45b46ec640f44b2e2aced55dc23556e	proof
PR #438	50 MRWK	github:charlielz	proof
PR #441	50 MRWK	mrwk19f8b55a3175013ba5d5f4015676c723a46affad8	proof
PR #439	50 MRWK	github:ipzex	proof