Issues

• Anomaly admin PUT /config returns 500 instead of 400 on bad input and accepts unbounded window sizes

  bugmedium
  Heliobond/backend#909 · Filter by author AbelOsaretin opened on Oct 16, 2026
  2

  

• Stray working files committed to the repo root and duplicated Unreleased sections in CHANGELOG

  bugdocumentationlow
  Heliobond/backend#908 · Filter by author AbelOsaretin opened on Oct 16, 2026
  6

  

• Scheduled Security Headers Audit job can never fail: it prints checkboxes but never exits non-zero

  buginfrastructurelow
  Heliobond/backend#907 · Filter by author AbelOsaretin opened on Oct 16, 2026
  3

  

• README contradicts CI and package.json on the audit gate, dependency pinning policy, and Stellar SDK version

  bugdocumentationmedium
  Heliobond/backend#902 · Filter by author AbelOsaretin opened on Oct 16, 2026
  3

  

• Event indexer permanently drops vault events: no getEvents pagination, cursor advances past failed txs, errors logged at debug

  bughigh
  Heliobond/backend#867 · Filter by author AbelOsaretin opened on Oct 16, 2026
  5

  

• withProjectLock is result-coalescing, not a lock: wrong results shared across callers and serialization abandoned after 30s

  bugmedium
  Heliobond/backend#866 · Filter by author AbelOsaretin opened on Oct 16, 2026
  6

  

• cleanupStaleWebhooks never reaps webhooks that have never successfully delivered, allowing unbounded growth

  bugmedium
  Heliobond/backend#865 · Filter by author AbelOsaretin opened on Oct 16, 2026
  7

  

• Webhook delivery retries 4xx as transient, has no fetch timeout, and fans out with no concurrency cap

  bugmedium
  Heliobond/backend#864 · Filter by author AbelOsaretin opened on Oct 16, 2026
  5

  

• Benchmarking percentile rank math is wrong, self-polluting, and trendVsBenchmark indexes a non-existent field

  bugmedium
  Heliobond/backend#856 · Filter by author AbelOsaretin opened on Oct 16, 2026
  1

• Financial math: failed IRR reported as 0%, B/C ratio divides by zero, and payback returns -1 for already-paid-back projects

  bugmedium
  Heliobond/backend#855 · Filter by author AbelOsaretin opened on Oct 16, 2026
  1

• CSRF origin check is skipped when Origin/Referer are absent, compares hostname only, and throws 500 on garbage Origin

  bugmediumsecurity
  Heliobond/backend#854 · Filter by author AbelOsaretin opened on Oct 16, 2026

• sanitizeInputs silently corrupts strings, overblocks legitimate input, and can pollute req.body's prototype

  bugmediumsecurity
  Heliobond/backend#853 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Dependency audit gates fail open: bun audit errors and unparseable output are treated as zero vulnerabilities

  bughighsecurity
  Heliobond/backend#852 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Release workflow cannot succeed: semantic-release plugins are not installed and npm publish targets a private package

  bughighinfrastructure
  Heliobond/backend#851 · Filter by author AbelOsaretin opened on Oct 16, 2026

• Deploys to staging and production are not gated on passing tests

  bughighinfrastructure
  Heliobond/backend#850 · Filter by author AbelOsaretin opened on Oct 16, 2026
  2

• Seven test suites (73 test cases) matching *.spec.ts are silently never executed by Jest

  bughightesting
  Heliobond/backend#849 · Filter by author AbelOsaretin opened on Oct 16, 2026
  3

• Impact certificates fall back to a hardcoded development signing key and annualize output across any period

  bughighsecurity
  Heliobond/backend#848 · Filter by author AbelOsaretin opened on Oct 16, 2026
  2

• Unbounded project_lifetime_years lets any API consumer exhaust CPU and memory via the financial endpoints

  bughigh
  Heliobond/backend#847 · Filter by author AbelOsaretin opened on Oct 16, 2026
  5

• Production Docker build is broken: npm ci runs with no package-lock.json and bun.lock is dockerignored

  bugcriticalinfrastructure
  Heliobond/backend#838 · Filter by author AbelOsaretin opened on Oct 16, 2026
  3

  

• Stale auth documentation: README claims ADMIN_API_KEY is optional, and API.md claims /api/portfolio and /v1/portfolio differ in auth

  documentationlow
  Heliobond/backend#837 · Filter by author AbelOsaretin opened on Oct 16, 2026
  9

  

• OpenAPI documents GET /portfolio without the {address} path parameter, so the generated api-client example 404s

  bugdocumentationmedium
  Heliobond/backend#836 · Filter by author AbelOsaretin opened on Oct 16, 2026
  7

  

• Error response bodies are inconsistent across routes: flat strings vs the documented { error: { code, message } } shape

  bugmedium
  Heliobond/backend#835 · Filter by author AbelOsaretin opened on Oct 16, 2026
  8