null - Dream

null closed issue null/BillTracker#73

2026-05-31 13:14:17 -05:00

HIGH: No process-level unhandledRejection/uncaughtException handler

null closed issue null/BillTracker#63

2026-05-31 13:12:42 -05:00

Overview page — Upcoming bills field hard to read

null commented on issue null/BillTracker#72

2026-05-31 13:12:16 -05:00

HIGH: Payment UPDATE/DELETE lack user_id in WHERE clause (defense-in-depth)

closed v0.34.2.1

null closed issue null/BillTracker#72

2026-05-31 13:12:16 -05:00

HIGH: Payment UPDATE/DELETE lack user_id in WHERE clause (defense-in-depth)

null commented on issue null/BillTracker#71

2026-05-31 13:09:22 -05:00

HIGH: SQL injection surface in analyticsService.js - string interpolation in WHERE clause

Both patterns are safe and no changes are needed. The report confused "string interpolation of SQL fragments" (safe, it's just building the query structure) with "string interpolation of user…

null closed issue null/BillTracker#71

2026-05-31 13:09:22 -05:00

HIGH: SQL injection surface in analyticsService.js - string interpolation in WHERE clause

null commented on issue null/BillTracker#70

2026-05-31 13:07:18 -05:00

CRITICAL: Incomplete user deletion - orphaned data risk

closed v0.34.2.1

null closed issue null/BillTracker#70

2026-05-31 13:07:18 -05:00

CRITICAL: Incomplete user deletion - orphaned data risk

null commented on issue null/BillTracker#69

2026-05-31 12:56:35 -05:00

CRITICAL: SMTP password stored in plaintext in SQLite

0.34.2.1 corrected

null closed issue null/BillTracker#69

2026-05-31 12:56:35 -05:00

CRITICAL: SMTP password stored in plaintext in SQLite

null commented on issue null/BillTracker#68

2026-05-31 12:46:13 -05:00

CRITICAL: Async route handlers lack try/catch - unhandled rejections crash process

v0.34.2.1 closed

null closed issue null/BillTracker#68

2026-05-31 12:46:13 -05:00

CRITICAL: Async route handlers lack try/catch - unhandled rejections crash process

null closed issue null/BillTracker#40

2026-05-31 12:31:12 -05:00

cycle_type and billing_cycle not acted on in statusService

null closed issue null/BillTracker#41

2026-05-31 12:31:12 -05:00

SimpleFIN Bank Sync — Backend + UI

null closed issue null/BillTracker#57

2026-05-31 12:31:12 -05:00

updateCheckService.js Forgejo URL is hard-coded with no env override

null closed issue null/BillTracker#15

2026-05-31 12:31:11 -05:00

Unit and integration tests

null closed issue null/BillTracker#16

2026-05-31 12:31:11 -05:00

Bill grouping and reorganization API

null closed issue null/BillTracker#39

2026-05-31 12:31:11 -05:00

UI for defining recurring bill generation rules

null opened issue null/BillTracker#85

2026-05-31 12:04:17 -05:00

LOW: Auto-generated encryption key stored in same SQLite database as encrypted data

null opened issue null/BillTracker#84

2026-05-31 12:04:12 -05:00

LOW: OIDC client secret stored in plaintext in user_settings table