Block a user
README has no Rationale section, which REPO_POLICIES requires
The .dockerignore database patterns do not match db.sqlite, and the repository's *.log and binary suffixes are missing from it
The home and status page footers say WTFPL while LICENSE and README say MIT
The WHOIS fetcher's success and error time lists grow without bound unless the stats endpoints are polled
The start-up WAL checkpoint log line labels the busy flag as wal_pages and always prints zeros after a successful checkpoint
The peering handler's dropped_paths log figure is never reset, so every run reports the total since start
The handler drop counter is written atomically but read without synchronisation, and the WHOIS fetcher pointer is set after the server starts serving
A prefix string that does not parse is written into the prefixes table and counted in the prefix totals
An announcement whose path gives no origin leaves the peer's old route live and cancels a withdrawal in the same batch
A new prefix's first_seen is the latest timestamp among the batch's updates for it, not the earliest
HEAD requests answer 405 on every route, and a 405 on the JSON routes says "Internal server error"
The IP lookup accepts an unbounded address list, gives PTR lookups no limit of their own, and echoes private addresses of internal names
The IP lookup answers 404 "No routes found" when the database read fails
The HTTP hardening REPO_POLICIES requires before a 1.0 tag is missing: security headers, trusted proxies for forwarded headers, generic error messages
The image builds and tests the daemon with Go 1.24, a release line that no longer receives security fixes
The WHOIS client reads a server's answer into memory with no size cap and follows a referral to any host and port
A WHOIS lookup whose RIR query fails or returns nothing is stored as complete and the AS is not retried for 30 days
The AS page reads every route of the AS, one random row per peer and prefix, so the largest ASes head for a 504 as the tables fill
The home page cannot look up any IPv6 address: percent-encoded URL parameters are read undecoded and answer 400
The 5-second TRUNCATE checkpoint holds the database lock for up to the busy timeout while any read is in progress, and logs the busy result as a success