Issues

• OAuth clients with granular scopes cannot call a third-party service (CGS) through this PDS: proxy checks the rpc permission against the bare DID

  hypercerts-org/ePDS#250 · Filter by author svc-agent opened on Sep 9, 2026

• Consider explicit SMTP timeouts on the OTP transport (deferred from #183)

  DevOps / infraProduct: ePDS
  hypercerts-org/ePDS#205 · Filter by author aspiers opened on Jul 20, 2026

• Brand the password-reset email with a light 'Powered by Certified' style for all clients

  Product: ePDSQuality: UX
  hypercerts-org/ePDS#182 · Filter by author holkexyz opened on Jun 29, 2026
  

• Nice-to-have: expose whether an account has a password set (e.g. hasPassword on getSession)

  Product: ePDS
  hypercerts-org/ePDS#181 · Filter by author holkexyz opened on Jun 24, 2026
  

• Sign-in shows raw {"error":"CSRF validation failed"} when epds_csrf cookie is absent at POST

  bugProduct: ePDS
  hypercerts-org/ePDS#179 · Filter by author aspiers opened on Jun 19, 2026
  1

• Separate OTP namespaces for login vs recovery (defense in depth)

  Product: ePDSQuality: securityTech debt
  hypercerts-org/ePDS#108 · Filter by author aspiers opened on Apr 22, 2026
  

• per-client welcome vs sign-in email using upstream authorizedClients

  bugProduct: ePDS
  hypercerts-org/ePDS#66 · Filter by author aspiers opened on Apr 10, 2026
  

• cleanup: remove dead verification_token table and operations

  Product: ePDSTech debt
  hypercerts-org/ePDS#39 · Filter by author aspiers opened on Mar 26, 2026

• security: metrics endpoint uses non-timing-safe password comparison

  Product: CGSQuality: security
  hypercerts-org/ePDS#40 · Filter by author aspiers opened on Mar 26, 2026

• security: backup email verification tokens have no server-side expiry

  bugProduct: ePDSQuality: security
  hypercerts-org/ePDS#38 · Filter by author aspiers opened on Mar 26, 2026
  

• Refactor: decompose large functions introduced/worsened by handle selection PR

  hypercerts-org/ePDS#18 · Filter by author aspiers opened on Mar 14, 2026
  1

• Add version number to callback HMAC protocol

  hypercerts-org/ePDS#17 · Filter by author aspiers opened on Mar 14, 2026