SendXpressXl

SendXpressXl/backend

2 stars 12 forks 2 watchers JavaScript
View on GitHub
18 Open Issues Need Help Last updated: Jun 28, 2026

Open Issues Need Help

View All on GitHub
Escrow release and refund have no idempotency guard, enabling double-spend on partial failure 14 days ago
bug help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add escrow transaction confirmation polling and on-chain verification 15 days ago
enhancement help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
Buyer's Stellar secret key is transmitted to the server in plaintext during escrow lock 16 days ago
bug help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add role-based access control with admin role and listing-ownership enforcement 16 days ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add per-user like/follow tracking with atomic toggle and likes table 17 days ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add JWT authentication strategy with guards and role extraction 17 days ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add authenticated state machine with transition logging and dispute resolution to deals 18 days ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add read receipts, message pagination, and duplicate-thread prevention to chat 18 days ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
security: Math.random() used for challenge nonce — not cryptographically secure about 1 month ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: POST /api/chat/messages has no body length limit — unbounded storage consumption about 1 month ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: PATCH /api/users/:id/role has no authentication — anyone can promote themselves to seller about 1 month ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: challenges Map in auth.js is never pruned — unbounded memory growth about 1 month ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: deal amount is never validated — unvalidated float string passed directly to Stellar payment operation about 1 month ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: requireAuth middleware is not applied to any mutation endpoint about 1 month ago
bug help wanted
SendXpressXl/backend
2

JavaScript
bug: POST /api/posts/:id/like is a non-atomic read-modify-write — concurrent likes cause lost updates about 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: GET /api/chat/messages has no authorization — any user can read any conversation about 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: deal state-change endpoints authorize via self-reported body params instead of session about 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: POST /api/deals accepts buyer private key in request body about 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript