Issues

• [BE-206] carrier-certifications.service.ts: create() and delete() are never audit-logged

  backendDifficulty: Mediumenhancement
  CodeGirlsInc/FrieghtFlow#1594 · Filter by author mftee opened on Sep 24, 2026
  6

• [BE-205] users.service.ts: update() allows changing email with no uniqueness pre-check

  backendbugDifficulty: Medium
  CodeGirlsInc/FrieghtFlow#1593 · Filter by author mftee opened on Sep 24, 2026
  2

• [BE-204] settlement-asset.util.ts: priceToBaseUnits() loses precision for large shipment prices via floating-point math

  backendbugDifficulty: Hard
  CodeGirlsInc/FrieghtFlow#1592 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-203] No health/readiness endpoint exists anywhere in the backend source tree

  backendbugDifficulty: Medium
  CodeGirlsInc/FrieghtFlow#1591 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-202] No global exception filter is registered anywhere in the backend

  backendbugDifficulty: Medium
  CodeGirlsInc/FrieghtFlow#1590 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-201] main.ts: no Helmet (or equivalent) security-headers middleware is registered

  backendbugDifficulty: Easy
  CodeGirlsInc/FrieghtFlow#1589 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-200] payments.controller.ts: getStatus() has two @ApiOperation decorators on the same method

  backendDifficulty: Easydocumentationgood first issue
  CodeGirlsInc/FrieghtFlow#1588 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-199] query-users.dto.ts: isActive's @Transform coerces any non-'true' string to false, including typos

  backendbugDifficulty: Easy
  CodeGirlsInc/FrieghtFlow#1587 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-198] shipments.service.ts: update() rejects admins even though @Roles(SHIPPER, ADMIN) permits them

  backendbugDifficulty: Medium
  CodeGirlsInc/FrieghtFlow#1586 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-197] create-shipment.dto.ts: price has a floor (Min 0.01) but no ceiling

  backendDifficulty: Easyenhancement
  CodeGirlsInc/FrieghtFlow#1585 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-196] shipments.service.ts: every status-transition method reloads the shipment a second time purely for the event payload

  backendDifficulty: Mediumenhancement
  CodeGirlsInc/FrieghtFlow#1584 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-195] documents.controller.ts: MIME-type allow-list is enforced only via the client-supplied Content-Type header

  backendDifficulty: Mediumenhancement
  CodeGirlsInc/FrieghtFlow#1583 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-194] PORT default disagrees between app-config.validation.ts (6000) and main.ts/Swagger (6006)

  backendbugDifficulty: Easygood first issue
  CodeGirlsInc/FrieghtFlow#1582 · Filter by author mftee opened on Sep 24, 2026
  2

• [BE-193] notifications.gateway.ts: WebSocket auth is validated only once, at handshake

  backendbugDifficulty: Medium
  CodeGirlsInc/FrieghtFlow#1581 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-192] carrier-certification.entity.ts: carrierId has no foreign-key relation to User

  backendbugDifficulty: Medium
  CodeGirlsInc/FrieghtFlow#1580 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-191] query-audit-log.dto.ts: only supports filtering by exact action string — no adminId, targetType, or date-range filters

  backendDifficulty: Mediumenhancement
  CodeGirlsInc/FrieghtFlow#1579 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-190] documents.controller.ts: file uploads have no dedicated rate limit or per-user storage quota

  backendDifficulty: Mediumenhancement
  CodeGirlsInc/FrieghtFlow#1578 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-189] settlement-asset.util.ts: XLM is declared as a supported settlement asset but is unreachable through the real funding flow

  backendbugDifficulty: Medium
  CodeGirlsInc/FrieghtFlow#1577 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-188] create-webhook.dto.ts: secret has no minimum length or entropy requirement

  backendDifficulty: Easyenhancement
  CodeGirlsInc/FrieghtFlow#1576 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-187] shipments.controller.ts: DisputeBody.reason and CancelBody.reason have no MaxLength

  backendDifficulty: Easyenhancementgood first issue
  CodeGirlsInc/FrieghtFlow#1575 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-186] create-review.dto.ts: comment has no MaxLength, unlike other free-text fields in the app

  backendDifficulty: Easyenhancementgood first issue
  CodeGirlsInc/FrieghtFlow#1574 · Filter by author mftee opened on Sep 24, 2026
  2

• [BE-185] notifications.service.ts: shipment fields are interpolated into HTML emails with no escaping

  backendbugDifficulty: Medium
  CodeGirlsInc/FrieghtFlow#1573 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-184] payments.controller.ts: the disabled test-sign-and-submit endpoint is fully documented in public Swagger regardless of ALLOW_TEST_SIGNING

  backendDifficulty: Easyenhancement
  CodeGirlsInc/FrieghtFlow#1572 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-183] admin.service.ts: reconcileEscrow() has a blind spot for CANCELLED payments

  backendbugDifficulty: Medium
  CodeGirlsInc/FrieghtFlow#1571 · Filter by author mftee opened on Sep 24, 2026
  1

• [BE-182] stellar-error-mapper.ts: ChainTimeoutError and SubmissionError are mapped to the same client-facing error code

  backendDifficulty: Mediumenhancement
  CodeGirlsInc/FrieghtFlow#1570 · Filter by author mftee opened on Sep 24, 2026
  1