SendXpressXl

SendXpressXl/backend

2 stars 12 forks 2 watchers JavaScript
View on GitHub
18 Open Issues Need Help Last updated: Jun 28, 2026

Open Issues Need Help

View All on GitHub
Chat system has no message ordering guarantee, no duplicate thread prevention, and no read receipts about 2 hours ago
bug help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
Buyer's Stellar secret key is transmitted to the server in plaintext during escrow lock about 2 hours ago
bug help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
No JWT strategy, guard, or role extraction exists — auth infrastructure is half-built and no route is protected about 2 hours ago
bug help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
Escrow transactions have no verifiable link to deals — memo overflow, no signature verification, no tx confirmation polling about 2 hours ago
bug help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
Deal state transitions have no authorization model — any caller can confirm, cancel, dispute, or ship any deal about 2 hours ago
bug help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
Social engagement system (likes, follows) has no user tracking, no atomicity, and no abuse prevention about 2 hours ago
bug help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
Role system has no permission boundaries — any user can escalate to seller, no admin role exists, listing ownership is not enforced about 2 hours ago
bug help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
Escrow release and refund have no idempotency guard, enabling double-spend on partial failure about 2 hours ago
bug help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
security: Math.random() used for challenge nonce — not cryptographically secure 18 days ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: POST /api/chat/messages has no body length limit — unbounded storage consumption 19 days ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: PATCH /api/users/:id/role has no authentication — anyone can promote themselves to seller 19 days ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: challenges Map in auth.js is never pruned — unbounded memory growth 19 days ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: deal amount is never validated — unvalidated float string passed directly to Stellar payment operation 19 days ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: requireAuth middleware is not applied to any mutation endpoint 21 days ago
bug help wanted
SendXpressXl/backend
2

JavaScript
bug: POST /api/posts/:id/like is a non-atomic read-modify-write — concurrent likes cause lost updates 25 days ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: GET /api/chat/messages has no authorization — any user can read any conversation 26 days ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: deal state-change endpoints authorize via self-reported body params instead of session 28 days ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: POST /api/deals accepts buyer private key in request body 28 days ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript