MergeFi

MergeFi/backend

0 stars 3 forks 0 watchers TypeScript
View on GitHub Website
100 Open Issues Need Help Last updated: Jul 15, 2026

Open Issues Need Help

View All on GitHub
TeamMemberSplit.teamId has no index despite being the delete/join key on every team-splits mutation 2 days ago
good first issue performance
MergeFi/backend
0

TypeScript
[Regression on closed #127] GithubStrategy still requests the unused read:org OAuth scope — closed by the same unrelated PR as #120 2 days ago
documentation good first issue
MergeFi/backend
0

TypeScript
reputation.service.spec.ts has no test for getLatest() 2 days ago
good first issue testing
MergeFi/backend
0

TypeScript
Two migrations share the identical timestamp 1784800000000 2 days ago
bug good first issue
MergeFi/backend
0

TypeScript
MaintenancePoolService.assignReward never checks MaintenancePool.status, so a PAUSED or CLOSED pool can still be drained 2 days ago
bug good first issue security
MergeFi/backend
0

TypeScript
ReputationSnapshot.userId has no database index despite being the only filter column on every query in ReputationService 2 days ago
good first issue performance
MergeFi/backend
0

TypeScript
roles.guard.spec.ts covers only 3 of 5 branches in RolesGuard.canActivate — the 'no roles required' short-circuit and the 'user deleted after token issued' path are untested 2 days ago
good first issue testing
MergeFi/backend
0

TypeScript
SponsorsController.dashboard's limit/offset query params have no validation, unlike the near-identical ReputationController.history implementation 2 days ago
bug good first issue
MergeFi/backend
0

TypeScript
JwtStrategy.validate and RolesGuard each perform an independent, redundant DB round-trip per request — one of which is discarded entirely unused 4 days ago
good first issue performance
MergeFi/backend
0

TypeScript
Repository.primaryLanguage has no index despite being a live BountiesController.list filter column 4 days ago
good first issue performance
MergeFi/backend
0

TypeScript
src/common/entities/index.ts exports github-account.entity.ts twice 4 days ago
documentation good first issue
MergeFi/backend
0

TypeScript
main.ts's startup log line uses raw console.log instead of NestJS's Logger, inconsistent with every other log line in the app 5 days ago
bug good first issue
MergeFi/backend
0

TypeScript
package.json's own engines.node is looser than typeorm's actual required Node range 5 days ago
documentation good first issue
MergeFi/backend
0

TypeScript
[Regression on closed #126] GithubWebhooksController's rawBody fallback still reconstructs an unsignable buffer — closed by an unrelated PR 5 days ago
documentation good first issue
MergeFi/backend
0

TypeScript
AuthController.me() has zero Swagger decorators — the only route in its controller neither documented nor deliberately excluded 5 days ago
documentation good first issue
MergeFi/backend
0

TypeScript
No DTO in the entire app uses @IsNotEmpty() — required free-text fields (milestone title, pool name, team name) accept whitespace-only or empty strings 5 days ago
bug good first issue
MergeFi/backend
0

TypeScript
computeContributorStats in contributor-stats.util.ts is dead code with a stale docstring claiming it's used by both Reputation and Analytics services 5 days ago
bug documentation good first issue
MergeFi/backend
0

TypeScript
BountyExpiryScheduler has no unit test coverage 5 days ago
good first issue testing
MergeFi/backend
0

TypeScript
CreateTeamDto.name has no @MaxLength, unlike every sibling free-text field the #151 fix covered 5 days ago
enhancement good first issue
MergeFi/backend
0

TypeScript
Neither BountiesController nor MilestonesController has a controller-level spec file, unlike TeamsController (which fixed #113) 5 days ago
good first issue testing
MergeFi/backend
0

TypeScript
CreateMilestoneDto still lacks future-deadline validation — the #108/#171 fix only covered bounties 5 days ago
bug good first issue
MergeFi/backend
0

TypeScript
The six inline controller-defined DTOs have zero @ApiProperty decorators, so Swagger UI renders blank request bodies for every money-moving and PII-setting endpoint that uses them 5 days ago
documentation good first issue
MergeFi/backend
0

TypeScript
CI runs the entire unit/integration test suite twice with no additional signal 5 days ago
good first issue performance
MergeFi/backend
0

TypeScript
README documents the pre-fix 30s stale-idempotency-key window; the code has run at 90s since the fix for #90 5 days ago
documentation good first issue
MergeFi/backend
0

TypeScript
IdempotencyKey.expiresAt has no @Index() in the entity despite the migration creating one for exactly that column 5 days ago
bug good first issue
MergeFi/backend
0

TypeScript
test/users.e2e-spec.ts has zero coverage for PATCH /users/:id/stellar-address 5 days ago
good first issue testing
MergeFi/backend
0

TypeScript
Add comprehensive test coverage for the bounty state machine, escrow release math, and webhook-to-payout integration flow (currently near-zero coverage) 26 days ago
help wanted very hard testing Maybe Rewarded GrantFox OSS Official Campaign | FWC26 Stellar Wave
MergeFi/backend
0

TypeScript
eslint fully disables @typescript-eslint/no-explicit-any, a third rule beyond the two the existing eslint-downgrade issue names 26 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
package.json has no engines field pinning a Node.js version, despite CI hardcoding Node 24 26 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
Roadmap's "recurring MaintenancePool deposits" item remains unimplemented — deposit() is entirely manual despite the monthlyDeposit field implying an automatic cadence 26 days ago
documentation enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
Structured tracing/observability is entirely absent: no correlation IDs across the webhook -> bounty -> escrow -> Soroban call chain 26 days ago
enhancement help wanted very hard architecture Maybe Rewarded GrantFox OSS Official Campaign | FWC26 Stellar Wave
MergeFi/backend
0

TypeScript
sponsors.service.spec.ts has no test for activeBounties(), activeMilestones(), or milestoneProgress() 26 days ago
enhancement good first issue help wanted testing Stellar Wave
MergeFi/backend
0

TypeScript
Global ValidationPipe uses forbidNonWhitelisted: false, silently stripping unexpected request body fields instead of rejecting them 27 days ago
bug enhancement good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
apportionBasisPoints doesn't validate that its own input sums to ~100 before force-normalizing the output — and has no test for that scenario 27 days ago
bug documentation good first issue performance testing Stellar Wave
MergeFi/backend
0

TypeScript
FundEscrowDto has no DTO-level cross-field validation for exactly-one-parent, relies entirely on service-layer assertExactlyOneParent 27 days ago
documentation enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
CreateMilestoneDto doesn't validate that deadline is in the future, same gap as CreateBountyDto (#108) 27 days ago
bug enhancement good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
None of the e2e-spec.ts files actually require real GitHub OAuth credentials, making CI's GITHUB_CLIENT_ID/SECRET gate unnecessary 27 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
CI's "Scan for Hardcoded Secrets" step only pattern-matches 3 narrow secret formats and never scans git history 27 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
team-split.util.ts's validateSplitPercentages and escrow.service.ts's assertValidSplits independently reimplement near-identical split-percentage validation 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService.release/splitRelease/releasePartial mark the escrow RELEASED before (or without a transaction around) creating the corresponding Payment row, so a Payment-insert failure leaves a permanently-mismarked ledger 27 days ago
bug help wanted spike architecture Stellar Wave
MergeFi/backend
0

TypeScript
ReputationService.computeAndSave and AnalyticsService.forContributor duplicate nearly identical contributor-stats computation logic 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
MaintenancePoolService.assignReward's repeated-releasePartial model has no counterpart in the real maintenance-pool contract either 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
CI's E2E test step has never run — GITHUB_CLIENT_ID/GITHUB_CLIENT_SECRET have never been configured as repository secrets 27 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
Several free-text DTO fields have no @MaxLength(), and their entity columns have no varchar length either 27 days ago
enhancement good first issue security performance Stellar Wave
MergeFi/backend
0

TypeScript
MilestonesService.resolveIssue's incremental-release model has no counterpart in the real mergefi-milestones contract 27 days ago
help wanted very hard security architecture Stellar Wave
MergeFi/backend
0

TypeScript
BountiesController.list only supports filtering by status, despite the API tracking difficulty, asset, and repository/language data 27 days ago
enhancement good first issue help wanted security Stellar Wave
MergeFi/backend
0

TypeScript
releasePartial()'s entire capability has no corresponding entrypoint on the real escrow contract 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService.release() and releasePartial() invoke the identical on-chain method name 'release' with incompatible argument shapes 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
TeamsService.create issues one separate INSERT per team member split instead of a single batched insert 27 days ago
good first issue help wanted performance architecture Stellar Wave
MergeFi/backend
0

TypeScript
WebhookEvent has no index on eventType, status, or receivedAt 27 days ago
documentation help wanted spike performance Stellar Wave
MergeFi/backend
0

TypeScript
CI workflow only triggers on pull_request to main — a direct push bypasses the entire pipeline including the secret scan 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService never passes contractId to soroban.invoke() — maintenancePoolContractId is completely dead configuration 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
GithubWebhooksService.handlePullRequest never reacts to a PR being opened — markInReview only ever fires synthetically at merge time 27 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService.splitRelease() invokes a 'split_release' method that doesn't exist on the real deployed contract 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
AnalyticsController.forContributor has no authentication guard 27 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
escrow.controller.spec.ts (the only controller spec in the codebase) exclusively tests metadata-stripping, not routing or idempotency wiring 27 days ago
help wanted very hard security testing Stellar Wave
MergeFi/backend
0

TypeScript
Issue.isMaintenanceType is computed and persisted on every GitHub sync but never read anywhere in the application 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
Issue.state is typed 'open' | 'closed' in TypeScript but stored as an unconstrained varchar with no DB-level enum or CHECK 27 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
Bounty.claimedById has no database index despite being the primary filter column for reputation and analytics 27 days ago
bug help wanted very hard performance Stellar Wave
MergeFi/backend
0

TypeScript
ReputationController has zero authentication guards, including POST /:userId/recompute 27 days ago
help wanted very hard security performance Stellar Wave
MergeFi/backend
0

TypeScript
JwtStrategy.validate trusts the JWT payload's sub/username with no database lookup at all 27 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
syncIssues has no page/issue cap and runs synchronously inside the POST /github/sync/:owner/:repo request 27 days ago
help wanted very hard performance architecture Stellar Wave
MergeFi/backend
0

TypeScript
GithubAccount.accessToken and refreshToken are stored in plaintext despite the code's own TODO acknowledging they need encryption at rest 27 days ago
help wanted very hard security architecture Stellar Wave
MergeFi/backend
0

TypeScript
SponsorsController has zero authentication guards, exposing a sponsor's full financial dashboard to any unauthenticated caller 27 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
AuthController.githubCallback puts the freshly issued JWT directly in the redirect URL's query string 27 days ago
help wanted very hard security architecture Stellar Wave
MergeFi/backend
0

TypeScript
upsertFromGithub's account-exists branch never refreshes User.username/displayName/email/avatarUrl on repeat login 27 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
UsersService.upsertFromGithub matches an existing User purely by username, enabling account takeover via GitHub username reuse 27 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
users.e2e-spec.ts's two "should reject unauthenticated requests with 401" tests both actually assert .expect(403) 27 days ago
bug good first issue security testing Stellar Wave
MergeFi/backend
0

TypeScript
extractLinkedIssueNumbers discards the owner/repo qualifier in cross-repo closing keywords, causing false-positive linkage 27 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
SetStellarAddressDto.stellarAddress is validated only with @IsString(), unlike every other Stellar-address-accepting DTO in the codebase 27 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
GithubWebhooksService.handleEvent marks unrecognized webhook event types as PROCESSED even though nothing was done 27 days ago
bug help wanted spike architecture Stellar Wave
MergeFi/backend
0

TypeScript
GithubStrategy requests the read:org OAuth scope but nothing in the codebase reads org membership data 27 days ago
good first issue help wanted security architecture Stellar Wave
MergeFi/backend
0

TypeScript
GithubSyncService.logRateLimitStatus consumes the rate-limit budget it's meant to conserve 27 days ago
help wanted very hard security performance Stellar Wave
MergeFi/backend
0

TypeScript
handlePullRequest only handles merged PRs — a PR closed without merging has no handler at all 27 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
GithubSyncService.getPullRequest is dead code with a misleading docstring claiming webhook fallback verification that never happens 27 days ago
bug documentation help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
GithubWebhooksController's rawBody fallback can never byte-match what GitHub actually signed 27 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
No controller in the codebase applies ParseUUIDPipe to :id-style route params 28 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
MilestonesService.addIssue has no milestone-status guard 28 days ago
bug enhancement help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
resolveIssue's three sequential non-transactional writes can desync milestone.distributed from the Payment ledger, enabling a double-pay on retry 28 days ago
bug help wanted very hard architecture Stellar Wave
MergeFi/backend
0

TypeScript
milestones.service.spec.ts has zero tests for resolveIssue() or addIssue() 28 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
TeamsController has no controller-level test file 28 days ago
enhancement help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
TeamMemberSplitDto.percentage has @IsNumber() but no @Min/@Max bound, unlike escrow's SplitRecipientDto 28 days ago
bug enhancement good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
MilestonesService.resolveIssue never verifies issueId belongs to milestoneId, letting any UUID drain the milestone's budget 28 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
MilestonesService.resolveIssue's unresolvedCount fallback to 1 lets a single call drain 100% of the remaining budget 28 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
CreateBountyDto doesn't validate that deadline is in the future 28 days ago
bug enhancement good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
TeamsService has no endpoint to update or remove a member split after creation 28 days ago
enhancement help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
computeSplitShares() in team-split.util.ts is unused dead code 28 days ago
documentation good first issue security testing Stellar Wave
MergeFi/backend
0

TypeScript
markMergedAndRelease's team-split payout path issues one userRepo.findOne() per split member instead of a single batched query 28 days ago
help wanted very hard performance architecture Stellar Wave
MergeFi/backend
0

TypeScript
JwtModule's expiresIn is cast via `as unknown as number`, masking a string/number type mismatch 28 days ago
bug good first issue help wanted architecture Stellar Wave
MergeFi/backend
0

TypeScript
bounties.service.spec.ts has no test for refund(), expireOverdue(), or the team-split branch of markMergedAndRelease() 28 days ago
enhancement good first issue help wanted testing Stellar Wave
MergeFi/backend
0

TypeScript
The bounty state machine and its own test suite document IN_REVIEW -> CLAIMED for a PR closed without merge, but nothing ever triggers it 28 days ago
bug help wanted very hard testing Stellar Wave
MergeFi/backend
0

TypeScript
Five AppConfig/stellar fields are populated from env vars but never read anywhere in the application 28 days ago
bug documentation help wanted very hard Stellar Wave
MergeFi/backend
0

TypeScript
BountiesService.markMergedAndRelease marks a team-assigned bounty PAID even when team.splits is empty, skipping the payout entirely 28 days ago
bug help wanted spike architecture Stellar Wave
MergeFi/backend
0

TypeScript
SwaggerModule serves the full OpenAPI docs UI at /api/docs unauthenticated in every environment, including production 28 days ago
bug good first issue help wanted security Stellar Wave
MergeFi/backend
0

TypeScript
IdempotencyInterceptor's 30s STALE_PROCESSING_MS window is shorter than SorobanClientService.pollTransaction's worst-case duration 28 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
MaintenancePoolService.deposit overwrites monthlyDeposit with the latest single deposit amount on every call 28 days ago
bug documentation good first issue help wanted Stellar Wave
MergeFi/backend
0

TypeScript
EscrowService.release/refund/splitRelease/releasePartial have no try/catch around soroban.invoke, unlike fund() 28 days ago
bug help wanted spike architecture Stellar Wave
MergeFi/backend
0

TypeScript
SorobanClientService.pollTransaction never distinguishes a FAILED on-chain transaction from a SUCCESS — only NOT_FOUND vs found 28 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript
EscrowController.splitRelease returns raw Payment[] entities, bypassing the toPublicEscrow response shaping every other escrow endpoint uses 28 days ago
bug documentation good first issue security architecture Stellar Wave
MergeFi/backend
0

TypeScript
Payment.recipientId and Payment.recipientAddress are independent, unvalidated fields with no cross-check between them 28 days ago
bug help wanted very hard security Stellar Wave
MergeFi/backend
0

TypeScript