Issues

• Add CSRF protection for form POST routes

  backendbughelp wantedsecurity
  Harshall25/ChatPulse#28 · Filter by author Harshall25 opened on Oct 12, 2026

• Stop tracking local database file and document safe setup

  backenddocumentationgood first issuehelp wantedsecurity
  Harshall25/ChatPulse#27 · Filter by author Harshall25 opened on Oct 12, 2026

• Add integration tests for Flask routes

  backendenhancementhelp wantedtesting
  Harshall25/ChatPulse#26 · Filter by author Harshall25 opened on Oct 12, 2026

• Fix Docker Compose database persistence path

  backendbugdockergood first issuehelp wanted
  Harshall25/ChatPulse#24 · Filter by author Harshall25 opened on Oct 12, 2026

• Replace print statements with structured logging

  backendenhancementgood first issuehelp wanted
  Harshall25/ChatPulse#25 · Filter by author Harshall25 opened on Oct 12, 2026

• Add unit tests for database functions

  backendenhancementgood first issuehelp wantedtesting
  Harshall25/ChatPulse#23 · Filter by author Harshall25 opened on Oct 12, 2026

• Improve accessibility for home and chat UI

  accessibilityenhancementfrontendgood first issuehelp wanted
  Harshall25/ChatPulse#22 · Filter by author Harshall25 opened on Oct 12, 2026

• [EPIC][SECURITY][P0] Security hardening: auth, authz, transport, and output escaping

  enhancementepicpriority: P0-criticalsecuritysecurity-severity: critical
  Harshall25/ChatPulse#21 · Filter by author Harshall25 opened on Sep 14, 2026

• [EPIC][P2] Presence, delivery/read receipts, typing indicators, and offline push

  enhancementepicofflinepriority: P2-medium
  Harshall25/ChatPulse#20 · Filter by author Harshall25 opened on Sep 14, 2026

• [EPIC][P0] Data layer: migrate to Postgres + offload files to object storage

  data-consistencyenhancementepicpriority: P0-critical
  Harshall25/ChatPulse#19 · Filter by author Harshall25 opened on Sep 14, 2026

• [EPIC][P1] Reliable messaging: durable ordering, acks, idempotency, and reconnect resync

  enhancementepicpriority: P1-highreliability
  Harshall25/ChatPulse#18 · Filter by author Harshall25 opened on Sep 14, 2026

• [EPIC][P0] Horizontal scale-out: Redis pub/sub broker + production app server + shared sessions

  enhancementepicpriority: P0-criticalscalability
  Harshall25/ChatPulse#17 · Filter by author Harshall25 opened on Sep 14, 2026

• [SECURITY][P2] Debug mode toggled by env var can expose Werkzeug RCE console

  bugpriority: P2-mediumsecuritysecurity-severity: medium
  Harshall25/ChatPulse#16 · Filter by author Harshall25 opened on Sep 14, 2026

• [SECURITY][P1] No authorization/room ACL; signin auto-creates accounts

  bugpriority: P1-highsecuritysecurity-severity: high
  Harshall25/ChatPulse#15 · Filter by author Harshall25 opened on Sep 14, 2026

• [SECURITY][P0] Stored/reflected XSS via room name, username, and file name

  bugpriority: P0-criticalsecuritysecurity-severity: critical
  Harshall25/ChatPulse#14 · Filter by author Harshall25 opened on Sep 14, 2026

• [SECURITY][P1] cors_allowed_origins="*" enables cross-site WebSocket hijacking

  bugpriority: P1-highsecuritysecurity-severity: high
  Harshall25/ChatPulse#13 · Filter by author Harshall25 opened on Sep 14, 2026

• [SECURITY][P0] Hardcoded Flask SECRET_KEY enables session forgery

  bugpriority: P0-criticalsecuritysecurity-severity: critical
  Harshall25/ChatPulse#12 · Filter by author Harshall25 opened on Sep 14, 2026

• [SECURITY][P0] Passwords stored and compared in plaintext

  bugpriority: P0-criticalsecuritysecurity-severity: critical
  Harshall25/ChatPulse#11 · Filter by author Harshall25 opened on Sep 14, 2026

• [P2] Filesystem sessions block load balancing

  bugpriority: P2-mediumscalability
  Harshall25/ChatPulse#10 · Filter by author Harshall25 opened on Sep 14, 2026

• [P1] Fire-and-forget delivery — no acks, no offline handling, messages silently lost

  bugofflinepriority: P1-highreliability
  Harshall25/ChatPulse#9 · Filter by author Harshall25 opened on Sep 14, 2026

• [P1] No pagination — every room load fetches all messages

  bugperformancepriority: P1-high
  Harshall25/ChatPulse#8 · Filter by author Harshall25 opened on Sep 14, 2026

• [P1] Reconnect duplicates full history in the DOM and stacks event handlers

  bugpriority: P1-highreliability
  Harshall25/ChatPulse#7 · Filter by author Harshall25 opened on Sep 14, 2026

• [P1] No message ordering guarantee or idempotency key

  bugdata-consistencypriority: P1-high
  Harshall25/ChatPulse#6 · Filter by author Harshall25 opened on Sep 14, 2026

• [P1] Room membership stored in HTTP session → messages routed to the wrong room

  bugpriority: P1-highrace-condition
  Harshall25/ChatPulse#5 · Filter by author Harshall25 opened on Sep 14, 2026

• [P0] File uploads base64-streamed through the socket & stored unbounded → OOM

  bugperformancepriority: P0-critical
  Harshall25/ChatPulse#4 · Filter by author Harshall25 opened on Sep 14, 2026