PHASE-STELLAR/Phase

`lib/utils.ts` `cn` `clsx` `tailwind-merge` `twMerge` Conflict: Tailwind v4 vs v3 `className` `cva` Variant Mismatch → Style Leak 10 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

`components/ui/dialog.tsx` `Dialog` `Modal` `focus-trap` Missing → Accessibility `focus` Leak, Screen Reader Bypass 11 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

`hooks/useWallet.ts` `useEffect` `cleanup` Missing `AbortController` → Memory Leak 100k `world` `useWallet` `100k` Listeners 11 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

`app/api/soroban-rpc/route.ts` `proxy` `rate-limit` Missing `breaker` → `soroban-rpc` `429` Storm 10k `forge` 429 12 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

`diagnose-env.ts` `env` `validation` `zod` `serverSchema` vs `clientSchema` Drift → `DISTRIBUTOR_SECRET` Bundle Leak 12 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

`vercel.json` `rewrites` `headers` `CORS` `wildcard` `*` `allow-credentials` `true` → `CORS` `bypass` `vercel.json` `rewrites` `headers` `CORS` 13 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

`public/` `assets` `caching` `immutable` `max-age` `31536000` `without` `hash` `fingerprint` → Stale Asset After Deploy 13 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

`lib/feature-flags.ts` `feature` `flag` `env` `NEXT_PUBLIC_FEATURE_*` `without` `server-only` → Secret Leak via Feature Flag 14 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Phaser LIQ SAC Warn Bypass: `phaser-liq-sac-warn.ts` `auth_clawback` Enables `clawback` Griefing on Classic LIQ Trustline 22 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Toast Queue Cold-Start Loss: `toast-queue.ts` In-Memory `Map` Resets on Vercel Cold Start, 50% Toasts Lost, No Deduplication 22 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

OG Design Tokens Cache Poisoning: `og-design-tokens.ts` `design` Tokens `public` Cache Leaks Private OG Image 23 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Phase Host Error Leak: `phase-host-error.ts` `host` Error Taxonomy Exposes `DISTRIBUTOR_SECRET` via `diagnose-env.ts` Log 24 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Metadata Migration Data Loss: `metadata-migration.ts` `migration` Loses `lore-versioning` 10M Rows on `project-docs-content` Update 25 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Story Arc Continuity Check Missing: `story-arc-continuity.ts` `checkArc` Never Called, World Canon Diverges Across 100k Tokens 25 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Project Docs Content XSS: `project-docs-content.ts` `dangerouslySetInnerHTML` Without Sanitization, `__proto__` Pollution via `phase-copy` 26 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Webhook Alerts Spam: `webhook-alerts.ts` `alert` Without `AuthRateLimiter` or `breaker` → Alert Storm 10k `webhooks` 429 27 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Faucet Health Cron Never Called: `app/api/cron/faucet-health/route.ts` `cron` `never` Wired to `JobScheduler` (Dead Code Like `cleanup_stale_sessions` in #000 Part D) 27 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Admin Quests Auth Missing: `app/api/admin/quests/route.ts` `admin` `quests` Without `admin_auth` → Unauthenticated Quest Grant 5 LIQ 28 minutes ago

help wanted ARCHITECTURE

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Narrator AI Prompt Injection: `app/api/narrator/route.ts` `narrator` `prompt` Injected via `narrative-world-store` User Lore → Malicious Lore Generation 29 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Get Owner Tokens Pagination Missing: `app/api/get_owner_tokens/index/route.ts` No `cursor`, 10k Tokens `5MB` Truncates, Vercel 5MB Limit 31 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Types `any` Escape: `types/` `types` `any` Allows `__proto__` Pollution Bypass of `SUPPORTED_LANGS` Allowlist 33 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Middleware Auth Bypass: `middleware.ts` `x-phase-lang` `NEXT_PUBLIC_` Audit `12` `process.env` Hits `DISTRIBUTOR_SECRET` Bundle Leak 34 minutes ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[PERFORMANCE] `tactical-ui-click.ts` `debounce` `100ms` Too Short → `10` `clicks`/sec `10`× `fetch` `429` about 1 hour ago

help wanted

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[SPIKE + SECURITY] `forge-nanobanana` Prompt Injection via User Lore → Malicious Image about 2 hours ago

help wanted SPIKE security

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[SECURITY + CORRECTNESS] `fractional-ownership` Rounding Dust Loss: 1 Stroop ×100k about 2 hours ago

help wanted SPIKE

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[SPIKE + REFACTOR] `world-conflict` Lost-Update: No OT, `lore-versioning` Truncation Race about 2 hours ago

help wanted SPIKE

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[SPIKE + SECURITY] `sybil-resistance` Bypass: Device Fingerprint Spoof, 10k Sybil Farm about 2 hours ago

help wanted SPIKE

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[PERFORMANCE] `nft-grid-virtualization` O(N²) Collapse at 100k-Token World Scale: No Windowing about 8 hours ago

help wanted advanced

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[SPIKE] Decentralized Content Addressing: IPFS vs Soroban `DataEntry` vs Arweave — Cost/Finality for 100k-Token World about 8 hours ago

help wanted SPIKE

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[SECURITY INTEGRATION] Wallet Kit Session Fixation via Freighter Deep-Link + `postMessage` Origin Confusion about 8 hours ago

help wanted SPIKE security

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[INTEGRATION] x402 Micropayment Channel Race & Sequence Bumping: Concurrent `x402/settle` `txBadSeq` about 8 hours ago

help wanted SPIKE integration

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[SPIKE + SMART CONTRACT] Soroban Storage Rent / TTL Exhaustion & Archive-Restore DoS: Unbounded `Map<TokenId, Metadata>` about 8 hours ago

help wanted SPIKE

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[ADVANCED REFACTOR] Next.js App Router Cache Poisoning & Tenant Cross-Pollution: `fetch` Memoization + ISR Leaks Private Collection about 8 hours ago

help wanted advanced

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[SECURITY SPIKE] Freighter Signature Replay Across Passphrase + Missing SEP-0050 Domain Separator: Testnet Sig Accepted as Mainnet about 8 hours ago

help wanted SPIKE

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

[SPIKE + REFACTOR] Atomic Settlement DvP Double-Mint Race: Horizon Lag + `phase-protocol` No Idempotency → Classic LIQ Double-Spend about 8 hours ago

help wanted SPIKE

PHASE-STELLAR/Phase

5

PHASE is a decentralized application where every AI-generated NFT requires a verified on-chain payment before it exists. There is no subscription, no custodial API key billing, and no way to receive the AI output without first settling PHASELQ on-chain. The payment is the key.

TypeScript

Open Issues Need Help