Issues - pixa - git.eeqj.de

sneak/pixa

Labels Milestones New Issue

TODO.md documents a branch-from-main workflow that no longer matches the next branching model

#106 opened 2026-08-10 16:14:39 +02:00 by clawbot 1.0.0

Run all linting in Docker via Dockerfile.lint + script/lint

#104 opened 2026-08-10 13:14:33 +02:00 by clawbot 1.0.0

Tracking: 1.0.0 sequencing and critical path

#103 opened 2026-08-09 16:10:39 +02:00 by clawbot

Eviction loop is not context-cancellable; shutdown ignores its deadline

#102 opened 2026-08-09 15:37:46 +02:00 by clawbot 1.0.0

script/cibuild can report a green it did not earn: docker layer cache can skip make check entirely

#101 opened 2026-08-09 07:37:54 +02:00 by clawbot 1.0.0

Markdown is never formatted: script/fmt covers only Go, and no prettier config exists

#100 opened 2026-08-09 07:04:41 +02:00 by clawbot 1.0.0

Port is not overridable with the PORT environment variable

#99 opened 2026-08-09 07:04:27 +02:00 by clawbot 1.0.0

CORS wildcard is applied at the router root, covering the cookie-authenticated routes

#98 opened 2026-08-09 07:04:11 +02:00 by clawbot 1.0.0

Repo layout: non-canonical root files, a confusing scripts/ directory, and a stale reformatted CONVENTIONS.md

#97 opened 2026-08-09 07:04:00 +02:00 by clawbot 1.0.0

Migrations are not at the mandated internal/db/migrations/ path or filenames

#96 opened 2026-08-09 07:03:39 +02:00 by clawbot 1.0.0

Dockerfile duplicates dependency installs inline instead of running script/bootstrap, and omits -trimpath / -s -w

#95 opened 2026-08-09 07:03:29 +02:00 by clawbot 1.0.0

Blocks 1.0: no trusted-proxy handling — every log line and login record shows the proxy's IP

#94 opened 2026-08-09 07:03:11 +02:00 by clawbot 1.0.0

Blocks 1.0: no CSRF protection on the cookie-authenticated POST / and POST /generate forms

#93 opened 2026-08-09 07:02:57 +02:00 by clawbot 1.0.0

Blocks 1.0: http.Server missing IdleTimeout and ReadHeaderTimeout (slowloris), no request body size limits

#92 opened 2026-08-09 07:02:42 +02:00 by clawbot 1.0.0

Blocks 1.0: missing HSTS, CSP, and Permissions-Policy security headers

#91 opened 2026-08-09 07:02:29 +02:00 by clawbot 1.0.0

Implement referer blocklist to prevent hotlinking

#90 opened 2026-08-09 03:51:22 +02:00 by clawbot 1.0.0

Write the deployment guide and an example reverse proxy config

#89 opened 2026-08-09 03:51:01 +02:00 by clawbot 1.0.0

Implement format=auto (Accept-header content negotiation)

#88 opened 2026-08-09 03:50:49 +02:00 by clawbot 1.0.0

httpfetcher.hostSems grows without bound, and VariantStorage.Delete orphans the .meta sidecar

#87 opened 2026-08-09 03:50:32 +02:00 by clawbot 1.0.0

Shutdown correctness: exit code always 0, two competing signal handlers, Sentry calls os.Exit from a goroutine

#86 opened 2026-08-09 03:50:20 +02:00 by clawbot 1.0.0

1 2 3