Issues

• Email uniqueness not checked before update, raw DB error returned to client

  bug
  windoze95/saltybytes#53 · Filter by author windoze95 opened on Mar 4, 2026

• Username has no maximum length enforced

  bug
  windoze95/saltybytes#52 · Filter by author windoze95 opened on Mar 4, 2026

• N+1 queries in AssociateTagsWithRecipe

  enhancement
  windoze95/saltybytes#51 · Filter by author windoze95 opened on Mar 4, 2026

• Similarity search includes source recipe in its own results

  bug
  windoze95/saltybytes#50 · Filter by author windoze95 opened on Mar 4, 2026

• WebSocket CheckOrigin blocks mobile/native clients (missing empty-origin case)

  bug
  windoze95/saltybytes#49 · Filter by author windoze95 opened on Mar 4, 2026

• ID header check vulnerable to timing attack

  security
  windoze95/saltybytes#48 · Filter by author windoze95 opened on Mar 4, 2026

• Image upload handler reads entire file into memory with no enforced size limit

  bug
  windoze95/saltybytes#47 · Filter by author windoze95 opened on Mar 3, 2026

• Transaction not rolled back on early return in UpdateRecipeWithHistoryEntry

  bug
  windoze95/saltybytes#46 · Filter by author windoze95 opened on Mar 3, 2026

• GET /v1/recipes/:recipe_id is publicly accessible without authentication

  bug
  windoze95/saltybytes#45 · Filter by author windoze95 opened on Mar 3, 2026

• S3 key built with raw user-supplied filename, enabling key injection

  bug
  windoze95/saltybytes#44 · Filter by author windoze95 opened on Mar 3, 2026

• Regex compiled per-call in hot paths

  enhancement
  windoze95/saltybytes#43 · Filter by author windoze95 opened on Mar 3, 2026

• N+1 queries and potential infinite loop in GetNodeAncestors

  enhancement
  windoze95/saltybytes#42 · Filter by author windoze95 opened on Mar 3, 2026

• OpenAI and S3 clients created per-request instead of reused

  enhancement
  windoze95/saltybytes#41 · Filter by author windoze95 opened on Mar 3, 2026

• Missing database indexes for common query patterns

  enhancement
  windoze95/saltybytes#40 · Filter by author windoze95 opened on Mar 3, 2026

• Inconsistent HTTP status codes for auth failures

  bug
  windoze95/saltybytes#39 · Filter by author windoze95 opened on Mar 3, 2026

• Missing Content-Type on S3 uploads

  bug
  windoze95/saltybytes#38 · Filter by author windoze95 opened on Mar 3, 2026

• gin.SetMode unconditionally set to ReleaseMode

  bug
  windoze95/saltybytes#37 · Filter by author windoze95 opened on Mar 3, 2026

• Go version mismatch between go.mod and Dockerfile

  bug
  windoze95/saltybytes#36 · Filter by author windoze95 opened on Mar 3, 2026

• Config validation error shows Go field name instead of env var name

  bug
  windoze95/saltybytes#35 · Filter by author windoze95 opened on Mar 3, 2026

• SetActiveNode does not verify node belongs to tree

  bug
  windoze95/saltybytes#34 · Filter by author windoze95 opened on Mar 3, 2026

• Transaction Begin() error not checked in UpdateRecipeWithHistoryEntry

  bug
  windoze95/saltybytes#33 · Filter by author windoze95 opened on Mar 3, 2026

• JSONB Scan methods don't handle NULL database values

  bug
  windoze95/saltybytes#32 · Filter by author windoze95 opened on Mar 3, 2026

• Slice append may corrupt underlying array in allergen analysis

  bug
  windoze95/saltybytes#31 · Filter by author windoze95 opened on Mar 3, 2026

• AutoMigrate errors silently ignored

  bug
  windoze95/saltybytes#30 · Filter by author windoze95 opened on Mar 3, 2026

• Photo import silently truncates at 10MB without error

  bug
  windoze95/saltybytes#29 · Filter by author windoze95 opened on Mar 3, 2026