Issues

• [WAVE-44] LOW: slaHoursForPlan / domainCapForPlan silently fall through on unexpected plan values — billing contract violation

  security
  liwala/ay-framework#359 · Filter by author walidboulanouar opened on Jul 14, 2026

• [WAVE-41] INFO: API key plaintext serialized in Next.js Server Action wire response

  security
  liwala/ay-framework#346 · Filter by author walidboulanouar opened on Jul 14, 2026

• [WAVE-39] LOW: No organization suspension state — API keys remain valid after plan cancellation

  security
  liwala/ay-framework#335 · Filter by author walidboulanouar opened on Jul 14, 2026

• [MEDIUM] auth.ts: ayg_ prefix included in API key hash — prefix is load-bearing key material but treated as cosmetic

  liwala/ay-framework#245 · Filter by author walidboulanouar opened on Jul 13, 2026

• fix(jobs): NRD path match_id always undefined — takedown idempotency key collapses to 'default', cross-day retry silently dropped

  bug
  liwala/ay-framework#221 · Filter by author walidboulanouar opened on Jul 13, 2026

• fix(jobs): circuit breaker consecutiveFailures only increments on exhausted retries — real disable threshold is much higher than configured

  bug
  liwala/ay-framework#220 · Filter by author walidboulanouar opened on Jul 13, 2026

• fix(jobs): webhookSweeperJob and monthlyReportCron missing explicit maxAttempts — may double-deliver on retry

  bug
  liwala/ay-framework#218 · Filter by author walidboulanouar opened on Jul 13, 2026

• fix(jobs): takedown.ts — single-channel domain stays active forever after 3 permanent provider failures, no escalation

  bug
  liwala/ay-framework#211 · Filter by author walidboulanouar opened on Jul 13, 2026

• fix(jobs): session-scoring.ts — DB flagged but Tinybird never ingested if all retries exhaust during ingest

  bug
  liwala/ay-framework#207 · Filter by author walidboulanouar opened on Jul 13, 2026

• fix(jobs): no Trigger.dev dev-vs-prod env consistency check — dev key in prod deployment fires jobs silently in wrong project

  bug
  liwala/ay-framework#194 · Filter by author walidboulanouar opened on Jul 13, 2026

• fix(scanner): SCANNER_SECRET has no zero-downtime rotation — coordinated deploy required to rotate

  bug
  liwala/ay-framework#190 · Filter by author walidboulanouar opened on Jul 13, 2026

• fix(scanner): Telegram monitor has no FloodWaitError backoff — rate-limit floods silently drop channel data

  bug
  liwala/ay-framework#180 · Filter by author walidboulanouar opened on Jul 13, 2026

• fix(jobs): monthly report cache not invalidated when new takedowns filed mid-month

  bug
  liwala/ay-framework#165 · Filter by author walidboulanouar opened on Jul 13, 2026

• bug(api): no DELETE /v1/reports/monthly or regenerate endpoint — admin cannot fix bad reports via API

  bug
  liwala/ay-framework#162 · Filter by author walidboulanouar opened on Jul 13, 2026

• bug(ai): dmca-writer.ts missing explicit 'under penalty of perjury' phrasing — DMCA §512(c)(3)(A)(vi) non-compliance

  bug
  liwala/ay-framework#160 · Filter by author walidboulanouar opened on Jul 13, 2026

• test(scanner): test_net_guard.py missing IPv4-mapped IPv6 SSRF bypass test cases

  bug
  liwala/ay-framework#157 · Filter by author walidboulanouar opened on Jul 13, 2026

• test(jobs): missing behavioral tests for telegramMonitorJob allowlist, fingerprintJob trigger, correlations route

  bug
  liwala/ay-framework#156 · Filter by author walidboulanouar opened on Jul 13, 2026

• bug(ai): arabic-nlp.ts has no prompt-injection sanitisation on Telegram message contents

  bug
  liwala/ay-framework#140 · Filter by author walidboulanouar opened on Jul 13, 2026

• bug(scanner): Python scanner has 83% zero test coverage — 10 of 12 modules untested

  bug
  liwala/ay-framework#138 · Filter by author walidboulanouar opened on Jul 13, 2026

• security(scanner): assert_safe_url() used with Camoufox — DNS rebinding window (should use resolve_safe_target)

  bug
  liwala/ay-framework#137 · Filter by author walidboulanouar opened on Jul 13, 2026

• LOW: webhook-sweeper.ts and net.ts have no unit tests — critical security helpers untested

  liwala/ay-framework#118 · Filter by author walidboulanouar opened on Jul 13, 2026

• LOW: DMCA email sender has no code-level DKIM/SPF enforcement — unauthenticated emails likely spam-filtered

  liwala/ay-framework#111 · Filter by author walidboulanouar opened on Jul 13, 2026

• LOW: pagination cursor is unsigned base64 JSON — clients can forge arbitrary time-travel positions

  liwala/ay-framework#106 · Filter by author walidboulanouar opened on Jul 13, 2026

• LOW: Knock notification triggers pass domain/classifierLabel with no maxLength cap

  liwala/ay-framework#102 · Filter by author walidboulanouar opened on Jul 13, 2026

• LOW: productsEnabled column uses text[] — no enum constraint allows invalid product names

  bug
  liwala/ay-framework#99 · Filter by author walidboulanouar opened on Jul 13, 2026