Issues - pixa - git.eeqj.de

sneak/pixa

Labels Milestones New Issue

No pixa-specific Prometheus metrics, and metrics are not collected at all unless credentials are configured

#85 opened 2026-08-09 03:50:01 +02:00 by clawbot 1.0.0

Response header gaps: no Vary, X-Request-ID not returned or propagated, /v1/e/ lacks ETag/HEAD/304

#84 opened 2026-08-09 03:49:48 +02:00 by clawbot 1.0.0

Capture upstream Last-Modified/ETag and support conditional revalidation

#83 opened 2026-08-09 03:49:30 +02:00 by clawbot 1.0.0

P1 privacy: EXIF and other metadata are not stripped from processed images

#82 opened 2026-08-09 03:49:19 +02:00 by clawbot 1.0.0

No load test verifying the documented 1k-5k req/s target

#81 opened 2026-08-09 03:49:02 +02:00 by clawbot 1.0.0

No integration test of the end-to-end image proxy flow

#80 opened 2026-08-09 03:48:52 +02:00 by clawbot 1.0.0

internal/middleware: CORS, logging, and the metrics auth gate are untested

#79 opened 2026-08-09 03:48:37 +02:00 by clawbot 1.0.0

httpfetcher: redirect-to-private-IP SSRF and semaphore release are untested

#78 opened 2026-08-09 03:48:28 +02:00 by clawbot 1.0.0

The auth UI and encrypted-URL flows have zero Go tests — only a manual shell script

#77 opened 2026-08-09 03:48:12 +02:00 by clawbot 1.0.0

internal/handlers has 4 tests: the 401 signature boundary and every error path are untested

#76 opened 2026-08-09 03:48:01 +02:00 by clawbot 1.0.0

Document the auth UI, encrypted-URL routes, q/fit parameters, and the undocumented config keys

#75 opened 2026-08-09 03:47:47 +02:00 by clawbot 1.0.0

README describes storage paths, formats, and features that do not match the code

#74 opened 2026-08-09 03:47:33 +02:00 by clawbot 1.0.0

Remove dead abstractions in imgcache: unimplemented Purge and three interfaces with no implementers

#73 opened 2026-08-09 03:46:08 +02:00 by clawbot 1.0.0

Silently swallowed errors: unparseable exp yields 401 instead of 400, sidecar write failures logged nowhere

#72 opened 2026-08-09 03:45:56 +02:00 by clawbot 1.0.0

maintenance_mode is configurable and reported by the healthcheck but does not affect any request

#71 opened 2026-08-09 03:45:38 +02:00 by clawbot 1.0.0

Cache.metaCache is dead: every cache hit does open+stat+ReadFile+JSON parse instead of the in-memory lookup README promises

#70 opened 2026-08-09 03:45:28 +02:00 by clawbot 1.0.0

CacheConfig.CacheTTL is configured but never read — cached variants never expire

#69 opened 2026-08-09 03:45:06 +02:00 by clawbot 1.0.0

Decide on SVG: it is accepted and rendered by libvips, and format=orig silently returns JPEG

#68 opened 2026-08-09 03:44:54 +02:00 by clawbot 1.0.0

P1: blocked networks config + SSRF gaps (CGNAT, benchmark, NAT64 ranges not blocked)

#67 opened 2026-08-09 03:44:32 +02:00 by clawbot 1.0.0

P1 security: no rate limiting or lockout on the signing-key login form

#66 opened 2026-08-09 03:44:20 +02:00 by clawbot 1.0.0

1 2 3