Search results

Test suite is a single tautological assertion — zero business logic, classification, or Edge Function behavior is tested

Status: Open.

#12 In Thanas-R/Virdis;

· tg12 opened on May 20, 2026

All Edge Functions pin deno.land/std@0.168.0 (~2.5 years old) — missing 50+ versions of security and HTTP fixes

Status: Open.

#11 In Thanas-R/Virdis;

· tg12 opened on May 20, 2026

GEE auth and expression helpers copy-pasted identically across 4 Edge Functions — security patches will be missed

Status: Open.

#10 In Thanas-R/Virdis;

· tg12 opened on May 20, 2026

No polygon input validation in GEE Edge Functions — unbounded vertex count and coordinate range accepted

Status: Open.

#9 In Thanas-R/Virdis;

· tg12 opened on May 20, 2026

Wildcard CORS (Access-Control-Allow-Origin: *) on all 8 Edge Functions enables cross-origin credential exfiltration

Status: Open.

#8 In Thanas-R/Virdis;

· tg12 opened on May 20, 2026

No rate limiting on any Edge Function — ndvi-timeseries amplifies one HTTP request to 40 GEE API calls

Status: Open.

#6 In Thanas-R/Virdis;

· tg12 opened on May 20, 2026

gee-ndvi-tiles returns the GEE service-account OAuth access token in the HTTP response body

Status: Open.

#5 In Thanas-R/Virdis;

· tg12 opened on May 20, 2026

get-mapbox-token Edge Function returns live Mapbox API token to any unauthenticated caller

Status: Open.

#4 In Thanas-R/Virdis;

· tg12 opened on May 20, 2026

All 8 Edge Functions disable JWT auth and expose paid AI/GEE/Mapbox APIs to unauthenticated callers

Status: Open.

#3 In Thanas-R/Virdis;

· tg12 opened on May 20, 2026