Gate MOCK_MODEL4_CONTRIBUTORS fallback so demo users do not leak into the public milestone funnel

[Benjtalkshow]

components/bounty-detail/bounty-detail-client.tsx:67 falls back to MOCK_MODEL4_CONTRIBUTORS when the bounty has no contributorProgress:

contributorProgress: bounty?.contributorProgress ?? MOCK_MODEL4_CONTRIBUTORS,

getFullMilestoneData is consumed by both the public MilestoneFunnel (visible to unauthenticated visitors) and the authenticated Model4MaintainerDashboard. A real bounty with no contributors will surface the demo names (Alice, Bob, David) as if they were real participants.

getRealContributors already exists for the public funnel path and returns [] instead of demo data, but any other consumer that calls getFullMilestoneData for public rendering is still exposed.

What to do

• Audit every call site of getFullMilestoneData and confirm none of them render in a public context. Public-only paths must use getRealContributors
• Gate the MOCK_MODEL4_CONTRIBUTORS fallback in getFullMilestoneData behind process.env.NODE_ENV === "development" so it only kicks in during local dev
• Add a brief code comment explaining why

Acceptance criteria

• In a production build, getFullMilestoneData never returns MOCK_MODEL4_CONTRIBUTORS
• Public-facing funnel renders an empty contributor list for bounties without contributorProgress
• Authenticated maintainer and contributor views still see real data when present, empty list otherwise

Files

• components/bounty-detail/bounty-detail-client.tsx

[linear]

BOU-300

[coderabbitai]

🔗 Related PRs

#55 - feat-Implement Bounty Status Logic & Anti-Squatting [merged]
#61 - feat: implement leaderboard api layer [merged]
#178 - Feat/competition bounty flow [merged]
#186 - Implement Multi-Winner Milestone Bounty Flow (Issue #173) [merged]
#265 - feat: implement maintainer dashboard actions for multi-winner milestone bounties [merged]

---

📝 Issue Planner

_{Check the box below or use the @coderabbitai plan command to generate an implementation plan and prompts that you can use with your favorite coding assistant.}

• Create Plan

---

🧪 Issue enrichment is currently in open beta.

You can configure auto-planning by selecting labels in the issue_enrichment configuration.

To disable automatic issue enrichment, add the following to your .coderabbit.yaml:

issue_enrichment:
  auto_enrich:
    enabled: false

💬 Have feedback or questions? Drop into our discord!

[noevidence1017]

@noevidence1017 has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Dear Maintainers,

I would like to apply to work on Issue #278, Gate MOCK_MODEL4_CONTRIBUTORS fallback so demo users do not leak into the public milestone funnel.

I have experience with React, TypeScript, and frontend application security. For this issue, I will audit all call sites of getFullMilestoneData to ensure it is not used in public rendering contexts, gate the MOCK_MODEL4_CONTRIBUTORS fallback behind process.env.NODE_ENV === "development" so it is available only during local development, add a clear code comment explaining the rationale, and verify that public views display an empty contributor list when no real contributor data exists while authenticated users continue to see real contributor information when available.

Before submitting my pull request, I will verify the changes in both development and production builds to ensure there are no behavioral regressions and that all acceptance criteria are met.

Thank you for your consideration. I look forward to contributing to the BoundlessFi project.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @noevidence1017 to this issue.

[Chigybillionz]

@Chigybillionz has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

I can take this up and deliver a fix. Please assign.

THANK you

ℹ️ Repo Maintainers: To accept this application, review their application or assign @Chigybillionz to this issue.

[DevSolex]

@DevSolex has applied to work on this issue as part of the Stellar Wave Program's 6th wave.

Hi Maintainer,

I’m a smart contract and full-stack developer and would love to contribute to this issue. I’m an experienced contributor with hands-on expertise in Rust, Soroban, Cairo, and TypeScript.

I’m passionate about building secure, scalable blockchain solutions, with a strong emphasis on writing clean and maintainable code. Based on the scope of this issue, I’m confident I can deliver a complete solution within 24 hours of assignment.

I’d greatly appreciate the opportunity to contribute and help move this forward.

ℹ️ Repo Maintainers: To accept this application, review their application or assign @DevSolex to this issue.

[leocagli]

Hi, I'd like to gate the MOCK_MODEL4_CONTRIBUTORS fallback so demo users don't leak into production. I can add an env-var guard (NODE_ENV !== 'production') and a unit test verifying the fallback is absent in prod mode. Could you assign me?

[drips-wave]

Congratulations, @AugistineCreates! 🎉 Your application was accepted by the repo's maintainers, and the issue is due on June 30, 2026.

🧑‍💻 @AugistineCreates: Please resolve the issue such that the repo's maintainers have enough time to review your contribution before the due date. You'll earn Points for completing the issue on-time, which will make you eligible for a share of the Stellar Wave Program's reward pool.

Warning

When opening a PR, please link it to this issue to ensure it gets tracked accurately. Points are awarded when this issue is marked as completed by the maintainer.

🤠 Repo maintainers: Please keep an eye on the contributor's progress and review their work before the due date. You can manage this issue, including adjusting its complexity and points, here.

🌊 Happy Wave 🌊

[drips-wave]

This issue has been completed by @AugistineCreates as part of the Stellar Wave Program's 6th Wave 🥳

😎 @AugistineCreates: You earned 400 Points for completing this issue! After the current Wave ends, you'll be eligible for a percentage of the Wave's reward pool based on the percentage of total points you've earned. Learn more here. You can also Leave a review to share your experience working on this issue.

🧑‍💻 Repo maintainers: How'd the contributor do? Leave a review to share your experience working with them.