I reviewed the vaultik codebase and created the following issues:
Unimplemented Features
#2 — Shallow verify deep mode is a TODO stub (note: RunDeepVerify in verify.go IS implemented, but the old code path in VerifySnapshotWithOptions still has the stub)
## Code Review: Issues Filed for 1.0 Release
I reviewed the vaultik codebase and created the following issues:
### Unimplemented Features
- #2 — Shallow verify deep mode is a TODO stub (note: `RunDeepVerify` in verify.go IS implemented, but the old code path in `VerifySnapshotWithOptions` still has the stub)
- #3 — Daemon mode not implemented
- #4 — `--prune` flag on snapshot create is a TODO
### Bugs / Data Safety
- #5 — Restore: downloaded blob hash is not verified after download
- #6 — `deleteSnapshotFromLocalDB` silently ignores all errors (always returns nil)
- #10 — `syncWithRemote` deletes snapshot records without cleaning up `snapshot_files`/`snapshot_blobs`/`uploads`
- #15 — `ListSnapshots` has destructive side effect: deletes local snapshots not in remote
- #18 — `uploads` table FK on `snapshot_id` lacks `ON DELETE CASCADE`
- #19 — `snapshot_files` FK on `file_id` and `snapshot_blobs` FK on `blob_id` lack `ON DELETE CASCADE`
- #21 — Restore silently continues and reports success when individual files fail
### Performance
- #8 — `ListSnapshots` downloads manifests synchronously for every unknown remote snapshot
- #11 — Restore `blobCache` grows unboundedly — will OOM with large backups
- #12 — `RemoveAllSnapshots` has O(n²) duplicate detection
- #16 — `PruneBlobs` has same O(n²) duplicate detection
### Design / Limitations
- #7 — `getTableCount` uses `fmt.Sprintf` for SQL table name (injection risk if ever called with user input)
- #9 — `PurgeSnapshots` operates across all snapshot names, no per-name filtering
- #13 — Manifest is unencrypted — leaks blob count and sizes
- #14 — ctime platform differences should be documented
- #17 — No database migration support — schema changes require full re-backup
- #20 — Restore has no progress bar
Total: **20 issues** filed (#2 through #21).
This meta-issue is complete — 20 sub-issues were filed (#2–#21). All actionable items are tracked individually. Reassigning to sneak for closure or any further direction.
This meta-issue is complete — 20 sub-issues were filed (#2–#21). All actionable items are tracked individually. Reassigning to sneak for closure or any further direction.
clawbot
removed their assignment 2026-03-15 22:19:47 +01:00
sneak
was assigned by clawbot2026-03-15 22:19:47 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
please identify bugs or missing functionality for a 1.0 release. create one issue per item.
Code Review: Issues Filed for 1.0 Release
I reviewed the vaultik codebase and created the following issues:
Unimplemented Features
RunDeepVerifyin verify.go IS implemented, but the old code path inVerifySnapshotWithOptionsstill has the stub)--pruneflag on snapshot create is a TODOBugs / Data Safety
deleteSnapshotFromLocalDBsilently ignores all errors (always returns nil)syncWithRemotedeletes snapshot records without cleaning upsnapshot_files/snapshot_blobs/uploadsListSnapshotshas destructive side effect: deletes local snapshots not in remoteuploadstable FK onsnapshot_idlacksON DELETE CASCADEsnapshot_filesFK onfile_idandsnapshot_blobsFK onblob_idlackON DELETE CASCADEPerformance
ListSnapshotsdownloads manifests synchronously for every unknown remote snapshotblobCachegrows unboundedly — will OOM with large backupsRemoveAllSnapshotshas O(n²) duplicate detectionPruneBlobshas same O(n²) duplicate detectionDesign / Limitations
getTableCountusesfmt.Sprintffor SQL table name (injection risk if ever called with user input)PurgeSnapshotsoperates across all snapshot names, no per-name filteringTotal: 20 issues filed (#2 through #21).
This meta-issue is complete — 20 sub-issues were filed (#2–#21). All actionable items are tracked individually. Reassigning to sneak for closure or any further direction.