SendXpressXl

SendXpressXl/backend

2 stars 12 forks 2 watchers JavaScript
View on GitHub
18 Open Issues Need Help Last updated: Jun 28, 2026

Open Issues Need Help

View All on GitHub
bug: deal amount is never validated — unvalidated float string passed directly to Stellar payment operation 10 days ago
bug help wanted Maybe Rewarded GrantFox OSS Third Campaign
SendXpressXl/backend
2

JavaScript
Escrow release and refund have no idempotency guard, enabling double-spend on partial failure about 1 month ago
bug help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add escrow transaction confirmation polling and on-chain verification about 1 month ago
enhancement help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
Buyer's Stellar secret key is transmitted to the server in plaintext during escrow lock about 1 month ago
bug help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add role-based access control with admin role and listing-ownership enforcement about 1 month ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add per-user like/follow tracking with atomic toggle and likes table about 1 month ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add JWT authentication strategy with guards and role extraction about 1 month ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add authenticated state machine with transition logging and dispute resolution to deals about 1 month ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add read receipts, message pagination, and duplicate-thread prevention to chat about 1 month ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
security: Math.random() used for challenge nonce — not cryptographically secure 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: POST /api/chat/messages has no body length limit — unbounded storage consumption 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: PATCH /api/users/:id/role has no authentication — anyone can promote themselves to seller 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: challenges Map in auth.js is never pruned — unbounded memory growth 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: requireAuth middleware is not applied to any mutation endpoint 2 months ago
bug help wanted
SendXpressXl/backend
2

JavaScript
bug: POST /api/posts/:id/like is a non-atomic read-modify-write — concurrent likes cause lost updates 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: GET /api/chat/messages has no authorization — any user can read any conversation 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: deal state-change endpoints authorize via self-reported body params instead of session 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: POST /api/deals accepts buyer private key in request body 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript