Issues

• Commit the initial Prisma migration and validate required env at startup

  backendhelp wanted
  Steller-Flow/stellflow-backend#52 · Filter by author Levi-Ojukwu opened on Sep 15, 2026

• Consolidate src/schemas and src/validators; delete the dead duplicate invoice schema and unused exports

  backendgood first issuehelp wanted
  Steller-Flow/stellflow-backend#51 · Filter by author Levi-Ojukwu opened on Sep 15, 2026

• OpenAPI: upload routes and /health undocumented, spec glob breaks in dist, missing Payment/Notification/AuditLog schemas

  documentationgood first issuehelp wanted
  Steller-Flow/stellflow-backend#50 · Filter by author Levi-Ojukwu opened on Sep 15, 2026
  1

• Test coverage: six of ten controllers untested, Prisma mock is missing auditLog

  help wantedtesting
  Steller-Flow/stellflow-backend#49 · Filter by author Levi-Ojukwu opened on Sep 15, 2026

• Rate limiting gaps: per-user limiter never applies, login lockout is dead code, no trust proxy

  help wantedsecurity
  Steller-Flow/stellflow-backend#48 · Filter by author Levi-Ojukwu opened on Sep 15, 2026
  1

• Error responses have four different shapes; Prisma, JSON-parse and payload errors all surface as 500

  backendhelp wanted
  Steller-Flow/stellflow-backend#47 · Filter by author Levi-Ojukwu opened on Sep 15, 2026

• Escrow state changes are three separate writes with no transaction

  backendhelp wanted
  Steller-Flow/stellflow-backend#46 · Filter by author Levi-Ojukwu opened on Sep 15, 2026

• Upload routes are never mounted, and multipart/form-data is blocked by the global content-type check

  backendgood first issuehelp wanted
  Steller-Flow/stellflow-backend#45 · Filter by author Levi-Ojukwu opened on Sep 15, 2026

• stellar.service.ts is a stub: nothing is verified on-chain and contract ids are fabricated

  backendhelp wanted
  Steller-Flow/stellflow-backend#44 · Filter by author Levi-Ojukwu opened on Sep 15, 2026

• POST /api/payments/webhook and /verify have no ownership or authenticity checks

  help wantedsecurity
  Steller-Flow/stellflow-backend#43 · Filter by author Levi-Ojukwu opened on Sep 15, 2026

• GET /api/invoices lets any user list other users' invoices via creatorId/recipientId

  help wantedsecurity
  Steller-Flow/stellflow-backend#42 · Filter by author Levi-Ojukwu opened on Sep 15, 2026

• Wallet linking is unverified: signature check is length > 0, and profile/register accept raw addresses

  help wantedsecurity
  Steller-Flow/stellflow-backend#41 · Filter by author Levi-Ojukwu opened on Sep 15, 2026
  1