All issues

audit F25 [tech-debt]: channel-creation sync semantics tested only at Playwright tier

#625

· intendednull opened

on May 4, 2026

audit F23 [tech-debt]: kicked-member rejection missing for Message / EditMessage / DeleteMessage / Reaction

#623

· intendednull opened

on May 4, 2026

audit F22 [quality]: search index `remove_*` mutations silently dropped on mailbox full

#622

· intendednull opened

on May 4, 2026

audit F21 [robustness]: silent persistence-actor mailbox failures swallow `OpenEventStore`

#621

· intendednull opened

on May 4, 2026

audit F18 [security]: CSP lacks `report-uri`/`report-to`, `require-trusted-types-for`, and `upgrade-insecure-requests`

#618

· intendednull opened

on May 4, 2026

audit F17 [security]: CSP connect-src allows `https:` and `wss:` to any origin (wildcard equivalent)

#617

· intendednull opened

on May 4, 2026

audit F16 [security]: localStorage read-failure silently mints a fresh identity, masking storage-disabled / private-mode / corruption as "first run"

#616

· intendednull opened

on May 4, 2026

audit F12 [robustness]: Content::Text/Reply/Edit/System/Reaction body strings unbounded; Content::validate is no-op for them

#612

· intendednull opened

on May 4, 2026

audit F11 [robustness]: EventKind String fields lack size caps in EventDag::insert

#611

· intendednull opened

on May 4, 2026

audit F9 [security]: VoteThreshold::Count(0) permits any single admin to unilaterally pass governance proposals

#609

· intendednull opened

on May 4, 2026

audit F8 [security]: RevokeAdmin against genesis author succeeds with multi-admin majority

#608

· intendednull opened

on May 4, 2026

audit F2 [tech-debt]: docker-compose.yml has zero healthchecks; depends_on waits only for container start

#602

· intendednull opened

on May 4, 2026