Search results

[Security][Critical] No Row Level Security on any application table — one accidental GRANT = total multi-tenant data breach

Status: Open.

#144 In willchen96/mike;

· bmersereau opened on May 16, 2026

PRs #108 and #109: vitest.config.ts missing isolate: true — inconsistent with #106 and #107

Status: Open.

#125 In willchen96/mike;

· bmersereau opened on May 13, 2026

PR #106: getUserIdFromRequest in supabase.ts still uses || "" pattern and creates a new client per call — dead code, should be removed

Status: Open.

#124 In willchen96/mike;

· bmersereau opened on May 13, 2026

projectChat.ts: STREAM_TIMEOUT_MS const is placed between import statements

Status: Open.

#119 In willchen96/mike;

· bmersereau opened on May 13, 2026

PR #108 and #109: editResolutionLogging tests fail — PII console.log still present after revert

Status: Open.

#116 In willchen96/mike;

· bmersereau opened on May 13, 2026

chore: PRs #108 and #109 contain undocumented documents.ts changes not referenced in PR body

Status: Open.

#115 In willchen96/mike;

· bmersereau opened on May 13, 2026

[Low] GET /chat returns all chats without pagination

Status: Open.

#105 In willchen96/mike;

· bmersereau opened on May 13, 2026

[Low] Most user_id columns are text — no FK referential integrity to auth.users

Status: Open.

#104 In willchen96/mike;

· bmersereau opened on May 13, 2026

[Low] Supabase admin client created on every authenticated request

Status: Open.

#103 In willchen96/mike;

· bmersereau opened on May 13, 2026

[Low] R2 errors swallowed without logging — outages invisible in server logs

Status: Open.

#102 In willchen96/mike;

· bmersereau opened on May 13, 2026

[Low] S3Client instantiated on every R2 operation — no singleton

Status: Open.

#101 In willchen96/mike;

· bmersereau opened on May 13, 2026

[Medium] No timeout on SSE/LLM stream — hung connections held indefinitely

Status: Open.

#100 In willchen96/mike;

· bmersereau opened on May 13, 2026