Issues

• Env validation falls back to localhost defaults in non-production, masking misconfiguration

  advancedbugGrantFox OSSMaybe RewardedopsThird Campaign
  ecotask-network/EcoTask-backend#83 · Filter by author cybermax4200 opened on Aug 22, 2026
  2

  

• Add a soak/concurrency test for the reward-payout + verification pipeline (double-spend detection)

  advancedGrantFox OSSMaybe RewardedreliabilitysecuritytestingThird Campaign
  ecotask-network/EcoTask-backend#82 · Filter by author cybermax4200 opened on Aug 22, 2026
  2

  

• Proof committed but verification enqueue fails can leave an orphaned PENDING proof with no recovery

  advancedbugGrantFox OSSMaybe RewardedreliabilityThird Campaign
  ecotask-network/EcoTask-backend#79 · Filter by author cybermax4200 opened on Aug 22, 2026
  3

  

• Graceful shutdown can forcibly kill in-flight Stellar payouts

  advancedGrantFox OSSMaybe RewardedreliabilitysecurityThird Campaign
  ecotask-network/EcoTask-backend#78 · Filter by author cybermax4200 opened on Aug 22, 2026
  2

  

• Untrusted file upload: multer trusts client mimetype; EXIF/image decode runs on attacker-crafted bytes

  advancedGrantFox OSSMaybe RewardedsecurityThird Campaign
  ecotask-network/EcoTask-backend#65 · Filter by author cybermax4200 opened on Aug 21, 2026
  4

  

• No Prisma/Postgres connection-pool sizing — exhaustion under multi-worker load

  advancedGrantFox OSSMaybe RewardedopsreliabilityThird Campaign
  ecotask-network/EcoTask-backend#64 · Filter by author cybermax4200 opened on Aug 21, 2026
  3

  

• Leaderboard loads all approved proofs into memory and aggregates in JS

  advancedGrantFox OSSMaybe RewardedperformanceThird Campaign
  ecotask-network/EcoTask-backend#62 · Filter by author cybermax4200 opened on Aug 21, 2026
  2

  

• Outbound webhook deliveries lack an idempotency key — at-least-once dispatch duplicates

  advancedbugGrantFox OSSMaybe RewardedreliabilityThird Campaign
  ecotask-network/EcoTask-backend#59 · Filter by author cybermax4200 opened on Aug 21, 2026
  4

  

• Notification outbox is marked SENT at enqueue time, not at delivery time

  advancedbugGrantFox OSSMaybe RewardedreliabilityThird Campaign
  ecotask-network/EcoTask-backend#57 · Filter by author cybermax4200 opened on Aug 21, 2026
  5

  

• Expired tasks can still have proofs auto-approved and paid

  advancedbugGrantFox OSSMaybe RewardedreliabilityThird Campaign
  ecotask-network/EcoTask-backend#55 · Filter by author cybermax4200 opened on Aug 21, 2026
  2

  

• Verification rows record the original positive verdict even when the proof is auto-rejected at capacity

  advancedbugdatabaseGrantFox OSSMaybe RewardedThird Campaign
  ecotask-network/EcoTask-backend#54 · Filter by author cybermax4200 opened on Aug 21, 2026
  2

  

• Stellar reward payments are not idempotent — retries/reclaims can double-spend

  advancedbugGrantFox OSSMaybe RewardedsecurityThird Campaign
  ecotask-network/EcoTask-backend#53 · Filter by author cybermax4200 opened on Aug 21, 2026
  4

  

• Proof finalization is not race-free across the auto-verifier worker, admin reviewer, and validator quorum

  advancedbugGrantFox OSSMaybe RewardedreliabilitysecurityThird Campaign
  ecotask-network/EcoTask-backend#52 · Filter by author cybermax4200 opened on Aug 21, 2026
  2

  

• Remove the HTML-escaping sanitizeInput middleware (or move encoding to the output layer) and clean up already-escaped data.

  bugGrantFox OSSMaybe RewardedThird Campaign
  ecotask-network/EcoTask-backend#12 · Filter by author cybermax4200 opened on Aug 17, 2026
  2

  

• Audit and fix route-level authorization so user profile data is not publicly enumerable.

  authGrantFox OSSMaybe RewardedsecurityThird Campaign
  ecotask-network/EcoTask-backend#11 · Filter by author cybermax4200 opened on Aug 17, 2026
  2

  

• Migrate string statuses/roles to real enums (or DB constraints) so invalid states are impossible.

  databaseGrantFox OSSMaybe RewardedThird Campaign
  ecotask-network/EcoTask-backend#5 · Filter by author cybermax4200 opened on Aug 16, 2026
  2

  

• Extend /health (or add /ready) to report queue/worker health and backlog so a stalled pipeline is observable.

  GrantFox OSSMaybe RewardedopsreliabilityThird Campaign
  ecotask-network/EcoTask-backend#2 · Filter by author cybermax4200 opened on Aug 16, 2026
  2