2026-08-08 - 2026-08-09
Overview
2 Pull requests proposed by 1 user
Proposed
#31 lint: adopt org-standard .golangci.yml and golangci-lint v2.12.2 (closes #14)
Proposed
#35 chore: root .editorconfig and hardened .gitignore (closes #15)
22 Issues created by 1 user
Opened
#14 Adopt the org-standard .golangci.yml and golangci-lint v2.12.2
Opened
#15 Dotfile compliance: add root .editorconfig, harden .gitignore, exclude .git from .dockerignore
Opened
#16 Unify the gate: root make check must cover the backend, and CI must route through script/
Opened
#17 Rework Dockerfile.backend to the mandated Go multistage lint-stage pattern
Opened
#18 Frontend image serves zero security headers; add the full REPO_POLICIES set to nginx.conf
Opened
#19 Backend hardening: missing IdleTimeout/ReadHeaderTimeout, no security headers, no trusted-proxy client IP
Opened
#20 POST /api/v1/reports is unauthenticated, wildcard-CORS, and unrated-limited
Opened
#21 make test is effectively a no-op: Go tests are compile stubs, frontend has no test framework
Opened
#22 Shutdown is broken: os.Exit races fx OnStop hooks, losing buffered reports on every restart
Opened
#23 Report ingest correctness: returns 200 on storage failure, 400 on oversize, logs untrusted body
Opened
#24 README.md and TODO.md are substantially inaccurate — 14 documented claims contradict the code
Opened
#25 Decision needed: the backend is not connected to anything — does it ship in 1.0?
Opened
#26 nginx: PORT env override is documented but does not exist; add it and server_tokens off
Opened
#27 Backend observability: fx logs bypass slog, Identify() is dead, Sentry/Prometheus config is parsed but unwired
Opened
#28 script/ and Makefile drift from the org models; make dev is not a shim, make build is missing
Opened
#29 src/main.js: 1262-line monolith with innerHTML injection sinks, unfrozen CONFIG, and duplicated logic
Opened
#30 Decision needed: repo layout does not match the canonical structure, and backend/ duplicates 7 repo-level files
Opened
#32 Node deprecation warning DEP0205 emitted on every frontend build
Opened
#33 make hooks and make docker both fail when run from a git worktree
Opened
#34 golangci config drift guard: failure message loops the operator when the org standard legitimately updates
Opened
#36 Exclude .git from .dockerignore once the builds no longer read git metadata
Opened
#37 CI can report a green it did not earn: script/cibuild serves make check from the Docker layer cache