Issues

• The access_token cookie is set without the secure flag outside NODE_ENV=production, including on HTTPS staging deploys

  good first issuesecurityStellar Wave
  MergeFi/backend#614 · Filter by author chonilius opened on Oct 13, 2026

• POST /milestones/:id/allocate and /bounties/:id/approve|reject are documented in Swagger as working operations

  documentationgood first issueStellar Wave
  MergeFi/backend#613 · Filter by author chonilius opened on Oct 13, 2026

• test/users.e2e-spec.ts expects 403 for an unauthenticated request, but JwtAuthGuard returns 401

  good first issueStellar Wavetesting
  MergeFi/backend#612 · Filter by author chonilius opened on Oct 13, 2026

• STELLAR_NETWORK and STELLAR_NETWORK_PASSPHRASE are never cross-checked

  bugsecurityStellar Wave
  MergeFi/backend#611 · Filter by author chonilius opened on Oct 13, 2026

• ESCROW_DEADLINE_SECONDS and PORT are parsed without validation — a typo makes every fund throw RangeError

  buggood first issueStellar Wave
  MergeFi/backend#610 · Filter by author chonilius opened on Oct 13, 2026

• deriveOnChainId hashes UUIDs into u64 keys with no collision check, and milestone/pool keys share the escrow contract's issue_id space

  bugsecurityStellar Wave
  MergeFi/backend#609 · Filter by author chonilius opened on Oct 13, 2026

• MaintenancePoolService.assignReward reports a stale balance in its 'exceeds pool balance' error

  buggood first issueStellar Wave
  MergeFi/backend#608 · Filter by author chonilius opened on Oct 13, 2026

• escrow.service.spec.ts has three unnecessary type assertions flagged as lint errors

  good first issueStellar Wavetesting
  MergeFi/backend#607 · Filter by author chonilius opened on Oct 13, 2026

• Controller specs pass unbound methods to expect() (unbound-method lint errors)

  good first issueStellar Wavetesting
  MergeFi/backend#606 · Filter by author chonilius opened on Oct 13, 2026

• Unused variables on main hide logic that was lost in merges (previousStatus, existingPool, callerUserId…)

  buggood first issueStellar Wave
  MergeFi/backend#605 · Filter by author chonilius opened on Oct 13, 2026

• common/validators/date.validator.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#604 · Filter by author chonilius opened on Oct 13, 2026

• common/validators/money.validator.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#603 · Filter by author chonilius opened on Oct 13, 2026

• common/validators/stellar-address.validator.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#602 · Filter by author chonilius opened on Oct 13, 2026

• config/configuration.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#601 · Filter by author chonilius opened on Oct 13, 2026

• config/validate-required-config.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#600 · Filter by author chonilius opened on Oct 13, 2026

• analytics/ttl-cache.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#599 · Filter by author chonilius opened on Oct 13, 2026

• users/users.mapper.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#598 · Filter by author chonilius opened on Oct 13, 2026

• users/users.controller.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#597 · Filter by author chonilius opened on Oct 13, 2026

• [Regression on closed #282] maintenance-pool, sponsors, reputation and analytics controllers still have no spec files

  Stellar Wavetesting
  MergeFi/backend#596 · Filter by author chonilius opened on Oct 13, 2026

• github/github-webhook-payload.util.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#595 · Filter by author chonilius opened on Oct 13, 2026

• auth/strategies/github.strategy.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#594 · Filter by author chonilius opened on Oct 13, 2026

• auth/strategies/jwt.strategy.ts has no spec file

  good first issueStellar Wavetesting
  MergeFi/backend#593 · Filter by author chonilius opened on Oct 13, 2026

• GET /bounties/:id and the other public read routes have no throttle beyond the global 120/min, and list routes are full-table scans

  performancesecurityStellar Wave
  MergeFi/backend#592 · Filter by author chonilius opened on Oct 13, 2026

• GET /milestones and GET /maintenance-pools return no repository or issues, so clients can't show what a milestone or pool belongs to

  buggood first issueStellar Wave
  MergeFi/backend#591 · Filter by author chonilius opened on Oct 13, 2026
  1

• FRONTEND_URL defaults to http://localhost:3001, but the Next.js frontend serves on :3000 — CORS and the OAuth redirect miss it

  buggood first issueStellar Wave
  MergeFi/backend#590 · Filter by author chonilius opened on Oct 13, 2026
  1