All issues

Search results

LOW: Dead code & dead UI sweep — empty components, commented-out pages, non-functional controls, debug logs

Status: Open.

#17 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

MEDIUM: Docker/compose run dev server in production; .env baked into image

Status: Open.

#16 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

MEDIUM: Query-layer bugs — debounce drops pending invalidations, stale reaction fetch flags across channels

Status: Open.

#14 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

MEDIUM: Auth/API layer — tokens in request bodies, ownership from localStorage, no axios timeout, reset-password token

Status: Open.

#13 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

MEDIUM: Cross-user state leaks — reaction store, profile caches, VoiceCallContext manager never reset on logout

Status: Open.

#12 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

MEDIUM: Voice stack bugs — double-join, stale hasActiveCall, dead duplicate implementations, client-controlled identity

Status: Open.

#11 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

MEDIUM: Unread/badge correctness — DM double-counts, PATCH per scroll frame, premature read-marking, API storms

Status: Open.

#10 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

MEDIUM: Real-time message loss — dropped events before cache exists, no DM resync on reconnect, pagination gaps

Status: Open.

#7 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

HIGH: CSP neutralized (unsafe-inline/unsafe-eval + wildcard connect-src); missing security headers

Status: Open.

#6 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

HIGH: Dev/demo/test pages shipped in production; voice feature hard-disabled but half-wired

Status: Open.

#5 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

HIGH: Email-verification redirects to /login which does not exist (404)

Status: Open.

#4 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026

HIGH: delete-account page broken — wrong URL path, no auth header, misleading error

Status: Open.

#3 In d-e-v-14/echo-web;

· d-e-v-14 opened on Aug 28, 2026