SendXpressXl

SendXpressXl/backend

2 stars 12 forks 2 watchers JavaScript
View on GitHub
18 Open Issues Need Help Last updated: Jun 28, 2026

Open Issues Need Help

View All on GitHub
Buyer's Stellar secret key is transmitted to the server in plaintext during escrow lock 9 days ago
bug help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
bug: deal amount is never validated — unvalidated float string passed directly to Stellar payment operation about 1 month ago
bug help wanted Maybe Rewarded GrantFox OSS Third Campaign
SendXpressXl/backend
2

JavaScript
Escrow release and refund have no idempotency guard, enabling double-spend on partial failure 2 months ago
bug help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add escrow transaction confirmation polling and on-chain verification 2 months ago
enhancement help wanted difficulty:hard
SendXpressXl/backend
2

JavaScript
Add role-based access control with admin role and listing-ownership enforcement 2 months ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add per-user like/follow tracking with atomic toggle and likes table 2 months ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add JWT authentication strategy with guards and role extraction 2 months ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add authenticated state machine with transition logging and dispute resolution to deals 2 months ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
Add read receipts, message pagination, and duplicate-thread prevention to chat 2 months ago
enhancement help wanted Maybe Rewarded GrantFox OSS difficulty:hard Official Campaign | FWC26
SendXpressXl/backend
2

JavaScript
security: Math.random() used for challenge nonce — not cryptographically secure 3 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: POST /api/chat/messages has no body length limit — unbounded storage consumption 3 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: PATCH /api/users/:id/role has no authentication — anyone can promote themselves to seller 3 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
bug: challenges Map in auth.js is never pruned — unbounded memory growth 3 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: requireAuth middleware is not applied to any mutation endpoint 3 months ago
bug help wanted
SendXpressXl/backend
2

JavaScript
bug: POST /api/posts/:id/like is a non-atomic read-modify-write — concurrent likes cause lost updates 3 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: GET /api/chat/messages has no authorization — any user can read any conversation 3 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: deal state-change endpoints authorize via self-reported body params instead of session 3 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript
security: POST /api/deals accepts buyer private key in request body 3 months ago
bug help wanted Maybe Rewarded GrantFox OSS Official Campaign
SendXpressXl/backend
2

JavaScript