Search results

[security] Realtime + Storage anon-key surface bypasses route-code authorization (RLS / Realtime-Auth gap)

backendBackend / APIBackend / API

frontendFrontend / UIFrontend / UI

securitySecurity / data exposureSecurity / data exposure

Status: Open.

#231 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 13, 2026

Hand-applied migrations have no runner/ordering table — drift hazard

backendBackend / APIBackend / API

infrastructure

P3Low priority / polishLow priority / polish

tech-debtCleanup / maintainabilityCleanup / maintainability

Status: Open.

#197 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

migration_cosmetics.sql adds FK constraints non-idempotently — re-run fails

backendBackend / APIBackend / API

P3Low priority / polishLow priority / polish

tech-debtCleanup / maintainabilityCleanup / maintainability

Status: Open.

#196 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

No UNIQUE constraint backs edge dedup — concurrent/duplicate edges

backendBackend / APIBackend / API

data-integrityCorrectness of stored/served dataCorrectness of stored/served data

P3Low priority / polishLow priority / polish

Status: Open.

#195 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

lib/api.ts and sse.ts use string-based error classification (drop HTTP status); streamSSE has no timeout

frontendFrontend / UIFrontend / UI

P3Low priority / polishLow priority / polish

tech-debtCleanup / maintainabilityCleanup / maintainability

Status: Open.

#192 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

auth/callback persists localStorage identity before confirming the live session; fire-and-forget /me

bugSomething isn't workingSomething isn't working

frontendFrontend / UIFrontend / UI

P3Low priority / polishLow priority / polish

Status: Open.

#191 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

No loading.tsx anywhere — route transitions show a blank main until client effects resolve

frontendFrontend / UIFrontend / UI

P3Low priority / polishLow priority / polish

tech-debtCleanup / maintainabilityCleanup / maintainability

Status: Open.

#188 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

Careers [slug] page returns 200 + fallback UI for invalid slugs (soft 404)

frontendFrontend / UIFrontend / UI

P3Low priority / polishLow priority / polish

seoSEO / metadata / crawlabilitySEO / metadata / crawlability

Status: Open.

#187 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

Library upload: inline '+ Add a course' succeeds but never appears in the per-file dropdown

bugSomething isn't workingSomething isn't working

frontendFrontend / UIFrontend / UI

P2Medium priorityMedium priority

Status: Open.

#186 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

Calendar initial-load failure is swallowed and rendered as a valid-looking empty calendar

bugSomething isn't workingSomething isn't working

frontendFrontend / UIFrontend / UI

P2Medium priorityMedium priority

Status: Open.

#185 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

QuizPanel strands the user on a blank screen when a quiz generates zero questions

bugSomething isn't workingSomething isn't working

frontendFrontend / UIFrontend / UI

P2Medium priorityMedium priority

Status: Open.

#184 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026

Flashcard import: switching back to the Paste tab silently wipes the deck built on other tabs

bugSomething isn't workingSomething isn't working

data-integrityCorrectness of stored/served dataCorrectness of stored/served data

frontendFrontend / UIFrontend / UI

P2Medium priorityMedium priority

Status: Open.

#183 In SaplingLearn/Sapling;

· Jose-Gael-Cruz-Lopez opened on Jun 12, 2026