All issues

Half-migrated `aud`+`repo` mix is rejected for queries but accepted for body-input procedures

#75

· aspiers opened

on Jul 28, 2026

make destroy XRPC remove `group_service` DID entry

#74

· aspiers opened

on Jul 27, 2026

Investigate reducing querystring metadata exposure of `repo` for query methods

#39

· aspiers opened

on Jun 8, 2026

Let group.register choose the target PDS (per-PDS invite codes)

#38

· aspiers opened

on Jun 8, 2026

Group-repo putRecord: add swapRecord / optimistic-concurrency support (currently silent last-writer-wins)

#24

· svc-agent opened

on May 29, 2026

[low] jti column in group_audit_log is always null — audit log lacks per-request traceability

Quality: security

#8

· aspiers opened

on Mar 27, 2026

[medium] GROUP_PDS_INVITE_CODE stored and forwarded as plaintext — leaked if config is exposed

Quality: security

#7

· aspiers opened

on Mar 27, 2026

[low] accessJwt/refreshJwt visible in heap dumps via AtpAgent in-memory sessions

Quality: security

#5

· aspiers opened

on Mar 27, 2026

[high] ENCRYPTION_KEY reachable from all handlers via AppContext — no serialisation guard

Quality: security

#3

· aspiers opened

on Mar 27, 2026