Issues

• withTransaction() gives no atomicity on the Neon driver path (silent degradation)

  data-lossdbreviewseverity::medium
  Jalez/hello-ui#50 · Filter by author Jalez opened on Jul 28, 2026

• creator-chat GET/DELETE are unauthenticated: any caller can read or wipe another user's AI chat

  apireviewsecuritysecurity-reviewseverity::critical
  Jalez/hello-ui#49 · Filter by author Jalez opened on Jul 28, 2026

• Playwright-generated test-results/.last-run.json is tracked

  opsreviewsecurity-reviewseverity::low
  Jalez/hello-ui#43 · Filter by author Jalez opened on Jul 23, 2026

• OAuth signature compared with plain string equality (timing side channel)

  lti-authreviewsecuritysecurity-reviewseverity::low
  Jalez/hello-ui#42 · Filter by author Jalez opened on Jul 23, 2026

• LMS-groups postMessage accepts any origin/source, guarded only by a broadcast requestId

  boardsreviewsecuritysecurity-reviewseverity::low
  Jalez/hello-ui#41 · Filter by author Jalez opened on Jul 23, 2026

• handleProgressSync merges arbitrary client keys into canonical room state

  reviewsecurity-reviewseverity::lowws-server
  Jalez/hello-ui#40 · Filter by author Jalez opened on Jul 23, 2026

• deleteUser performs two dependent deletes without a transaction

  data-lossdbreviewsecurity-reviewseverity::low
  Jalez/hello-ui#39 · Filter by author Jalez opened on Jul 23, 2026

• drawboard artifact memory cache re-stamps a fresh 24h TTL, serving expired rows

  collabreviewsecurity-reviewseverity::low
  Jalez/hello-ui#38 · Filter by author Jalez opened on Jul 23, 2026

• Stale root package-lock.json coexists with canonical pnpm-lock.yaml

  opsreviewsecurity-reviewseverity::low
  Jalez/hello-ui#37 · Filter by author Jalez opened on Jul 23, 2026

• getOrCreateUserByEmail is a non-atomic check-then-insert

  dbrace-conditionreviewsecurity-reviewseverity::low
  Jalez/hello-ui#36 · Filter by author Jalez opened on Jul 23, 2026

• Bare ./docker-up.sh exits immediately (shift with no args under set -e)

  opsreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#35 · Filter by author Jalez opened on Jul 23, 2026

• documents/source_files/document_* tables never created on fresh installs

  data-lossdbreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#34 · Filter by author Jalez opened on Jul 23, 2026

• Migration 0002 uses plain CREATE TABLE, colliding with 0001 and the SQL bootstrap

  dbreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#33 · Filter by author Jalez opened on Jul 23, 2026

• Migration-verify script is broken and always fails

  dbreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#32 · Filter by author Jalez opened on Jul 23, 2026

• Grade submission trusts client points/maxPoints (self-awarded LMS grades)

  lti-authreviewsecuritysecurity-reviewseverity::medium
  Jalez/hello-ui#31 · Filter by author Jalez opened on Jul 23, 2026

• OAuth base string uses non-RFC3986 encoding; URL query params not signed

  lti-authreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#30 · Filter by author Jalez opened on Jul 23, 2026

• useGamePageBootstrap: uncancelled async race binds room to previous group

  boardsrace-conditionreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#29 · Filter by author Jalez opened on Jul 23, 2026

• DraggableFloatingPanel stale-closure listeners drop position persistence

  data-lossreviewsecurity-reviewseverity::mediumui
  Jalez/hello-ui#28 · Filter by author Jalez opened on Jul 23, 2026

• pixels message handler validates neither source nor origin (score spoofing)

  reviewsecuritysecurity-reviewseverity::mediumui
  Jalez/hello-ui#27 · Filter by author Jalez opened on Jul 23, 2026

• Tooltip close effect depends on unstable surfaceContent ReactNode

  reviewsecurity-reviewseverity::mediumui
  Jalez/hello-ui#26 · Filter by author Jalez opened on Jul 23, 2026

• setStepAccuracy stamps completion-time drawingVersion, marking pre-edit results fresh

  collabreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#25 · Filter by author Jalez opened on Jul 23, 2026

• Artifact hydration overwrites a newer live capture / stale flag (in-flight race)

  collabrace-conditionreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#24 · Filter by author Jalez opened on Jul 23, 2026

• mergeSavedPoints overwrites locally-earned higher points with stale lower values

  collabrace-conditionreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#23 · Filter by author Jalez opened on Jul 23, 2026

• Failed progress PATCH is recorded as saved and never retried

  collabdata-lossreviewsecurity-reviewseverity::medium
  Jalez/hello-ui#22 · Filter by author Jalez opened on Jul 23, 2026

• withAdminOrUserAuth: isSelf is always true (dead authorization branch)

  apireviewsecurity-reviewseverity::medium
  Jalez/hello-ui#21 · Filter by author Jalez opened on Jul 23, 2026