Issues

• SSRF guard re-resolves DNS at connect time, so rebinding is still possible

  area:securityhelp wanted
  Divinity-Labs/Lens#515 · Filter by author Miracle656 opened on Oct 18, 2026

• Admin routes are public and that is load-bearing

  area:securitydifficulty:easyhelp wantedpoints:100
  Divinity-Labs/Lens#514 · Filter by author Miracle656 opened on Oct 18, 2026
  2

• A caller cannot see their own usage

  area:api-qualitydifficulty:intermediatehelp wantedpoints:150
  Divinity-Labs/Lens#513 · Filter by author Miracle656 opened on Oct 18, 2026
  2

• The key is accepted only as a bearer token, and nothing says so

  area:docsdifficulty:easyhelp wantedpoints:100Stellar Wave
  Divinity-Labs/Lens#512 · Filter by author Miracle656 opened on Oct 18, 2026
  3

  

• A 401 says the same thing for four different problems

  area:api-qualitydifficulty:easyhelp wantedpoints:100Stellar Wave
  Divinity-Labs/Lens#511 · Filter by author Miracle656 opened on Oct 18, 2026
  6

  

• The admin surface has no tests

  area:testingdifficulty:intermediatehelp wantedpoints:150Stellar Wave
  Divinity-Labs/Lens#510 · Filter by author Miracle656 opened on Oct 18, 2026
  4

  

• Rate limiting is per key, with no global ceiling

  area:reliabilitydifficulty:intermediatehelp wantedpoints:150Stellar Wave
  Divinity-Labs/Lens#509 · Filter by author Miracle656 opened on Oct 18, 2026
  5

  

• An unset ADMIN_TOKEN disables the admin surface silently

  area:configdifficulty:easyhelp wantedpoints:100Stellar Wave
  Divinity-Labs/Lens#508 · Filter by author Miracle656 opened on Oct 18, 2026
  3

• Nothing counts authentication failures

  area:observabilitydifficulty:easyhelp wantedpoints:100Stellar Wave
  Divinity-Labs/Lens#507 · Filter by author Miracle656 opened on Oct 18, 2026
  7

  

• Key quotas are stored exactly as sent

  area:api-qualitydifficulty:easyhelp wantedpoints:100Stellar Wave
  Divinity-Labs/Lens#506 · Filter by author Miracle656 opened on Oct 18, 2026
  5

  

• There is no way to see what keys exist

  area:dxdifficulty:easyhelp wantedpoints:100Stellar Wave
  Divinity-Labs/Lens#505 · Filter by author Miracle656 opened on Oct 18, 2026
  3

• Every key can call every route

  area:securitydifficulty:advancedhelp wantedpoints:200Stellar Wave
  Divinity-Labs/Lens#504 · Filter by author Miracle656 opened on Oct 18, 2026
  2

• Revoking a key does not disconnect anything

  area:securitydifficulty:intermediatehelp wantedpoints:150Stellar Wave
  Divinity-Labs/Lens#503 · Filter by author Miracle656 opened on Oct 18, 2026
  2

• The websocket asks for nothing

  area:securitydifficulty:advancedhelp wantedpoints:200Stellar Wave
  Divinity-Labs/Lens#502 · Filter by author Miracle656 opened on Oct 18, 2026
  5

• There is no way to rotate a key

  area:securitydifficulty:intermediatehelp wantedpoints:150Stellar Wave
  Divinity-Labs/Lens#501 · Filter by author Miracle656 opened on Oct 18, 2026
  5

• Nothing records when a key was last used

  area:observabilitydifficulty:intermediatehelp wantedpoints:150Stellar Wave
  Divinity-Labs/Lens#500 · Filter by author Miracle656 opened on Oct 18, 2026
  3

• API keys never expire

  area:securitydifficulty:intermediatehelp wantedpoints:150Stellar Wave
  Divinity-Labs/Lens#499 · Filter by author Miracle656 opened on Oct 18, 2026
  3

• Nothing records that a key was minted or revoked

  area:securitydifficulty:intermediatehelp wantedpoints:150Stellar Wave
  Divinity-Labs/Lens#498 · Filter by author Miracle656 opened on Oct 18, 2026
  3

• No admin action has an author

  area:securitydifficulty:advancedhelp wantedpoints:200Stellar Wave
  Divinity-Labs/Lens#497 · Filter by author Miracle656 opened on Oct 18, 2026
  3

• The admin check is copy-pasted into two files

  area:securitydifficulty:easyhelp wantedpoints:100Stellar Wave
  Divinity-Labs/Lens#496 · Filter by author Miracle656 opened on Oct 18, 2026
  3

  

• Every authenticated request costs a database round-trip

  area:performancedifficulty:intermediatehelp wantedpoints:150Stellar Wave
  Divinity-Labs/Lens#495 · Filter by author Miracle656 opened on Oct 18, 2026
  3

• The MCP server has no metrics

  area:observabilitydifficulty:easyhelp wantedpoints:100Stellar Wave
  Divinity-Labs/Lens#425 · Filter by author Miracle656 opened on Oct 17, 2026
  2

  

• Tool descriptions do not tell an agent when to stop

  area:mcpdifficulty:easyhelp wantedpoints:100Stellar Wave
  Divinity-Labs/Lens#424 · Filter by author Miracle656 opened on Oct 17, 2026
  4

  

• No test drives a real 402 payment loop

  area:testingdifficulty:advancedhelp wantedpoints:200Stellar Wave
  Divinity-Labs/Lens#423 · Filter by author Miracle656 opened on Oct 17, 2026
  6

  

• Only the error paths of one tool are tested

  area:testingdifficulty:intermediatehelp wantedpoints:150Stellar Wave
  Divinity-Labs/Lens#421 · Filter by author Miracle656 opened on Oct 17, 2026
  8