Block a user
Shallow verify path: deep verification is a TODO stub
Fixed. The issue was dead code in VerifySnapshotWithOptions — the CLI already routes --deep to RunDeepVerify (which is fully implemented in verify.go), so the TODO stub inside `VerifySnap…
find bugs or incomplete functionality for 1.0
Code Review: Issues Filed for 1.0 Release
I reviewed the vaultik codebase and created the following issues:
Unimplemented Features
- #2 — Shallow verify deep mode is a TODO stub (note:…
Restore silently continues when individual file restoration fails
Restore has no progress bar for file restoration
snapshot_files FK on file_id lacks ON DELETE CASCADE
uploads table FK on snapshot_id lacks ON DELETE CASCADE
No database migration support — schema changes require full re-backup
PruneBlobs has O(n²) duplicate snapshot ID detection
Manifest is unencrypted — leaks blob count and sizes
ListSnapshots has destructive side effect: deletes local snapshots not in remote
ctime is in schema and model but verify scanner populates it correctly
RemoveAllSnapshots has O(n²) duplicate detection for snapshot IDs
Restore: blobCache grows unboundedly, will OOM with large backups
syncWithRemote deletes snapshot records without cleaning up related tables
PurgeSnapshots operates across all snapshot names, no per-name filtering
ListSnapshots downloads manifests synchronously for unknown remote snapshots
getTableCount uses fmt.Sprintf for SQL table name — potential SQL injection
deleteSnapshotFromLocalDB silently ignores all errors
--prune flag on snapshot create is a TODO
Restore: downloaded blob hash is not verified