NullX Finding 1: GET /api/notifications?read=false with no type param fell through to the all-notifications branch, silently ignoring the read filter. Added findByRecipientIdAndReadFalseOrderByCreatedAtDesc to NotificationRepository and the missing Boolean.FALSE.equals(read) branch in NotificationService. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>