mealprep

Invite flow: multi-member onboarding — single-use vs reusable link

#60 opened 2026-04-10 20:47:45 +02:00 by marcel

feat(staples): rework settings page — tile layout, seed catalog, add ingredient

#59 opened 2026-04-10 20:22:55 +02:00 by marcel 0 / 9

6

security: audit-log for role changes and member removal in household

#57 opened 2026-04-10 18:25:43 +02:00 by marcel 0 / 4

security: invalidate session immediately when member is removed from household

#56 opened 2026-04-10 18:24:46 +02:00 by marcel 0 / 3

feat(variety): implement C3 warning cards with recipe names and swap links (V1)

#51 opened 2026-04-09 16:31:58 +02:00 by marcel 0 / 9

5

feat(settings): implement E4 variety score settings (J9)

#50 opened 2026-04-09 16:13:53 +02:00 by marcel 0 / 9

5

Frontend: A4 — Join household (accept invite) kind/feature priority/medium

#21 opened 2026-04-02 11:26:52 +02:00 by marcel 0 / 6

10

No password complexity requirements beyond minimum length kind/security priority/low

#15 opened 2026-04-02 11:21:37 +02:00 by marcel

5

createInvite has no role check — any member can invite kind/security priority/low

#14 opened 2026-04-02 11:21:33 +02:00 by marcel

5

No household-level DB enforcement — isolation relies solely on application code kind/security priority/medium

#13 opened 2026-04-02 11:21:28 +02:00 by marcel

5

Shopping list addItem does not validate ingredient belongs to household kind/security priority/medium

#12 opened 2026-04-02 11:21:22 +02:00 by marcel

5

Unbounded limit/offset parameters allow resource exhaustion kind/security priority/medium

#11 opened 2026-04-02 11:21:16 +02:00 by marcel

5

No CORS configuration — will block frontend or risk misconfiguration kind/security priority/medium

#10 opened 2026-04-02 11:21:10 +02:00 by marcel

5

Admin audit log does not capture IP addresses kind/security priority/medium

#9 opened 2026-04-02 11:21:07 +02:00 by marcel

5

Login error responses enable account enumeration via HTTP status codes kind/security priority/high

#8 opened 2026-04-02 11:20:46 +02:00 by marcel

5

Missing catch-all exception handler — stack traces leak to clients kind/security priority/high

#7 opened 2026-04-02 11:20:41 +02:00 by marcel

5

Swagger UI exposed to unauthenticated users in all environments kind/security priority/high

#6 opened 2026-04-02 11:20:35 +02:00 by marcel

5

No validation on systemRole values — arbitrary roles accepted kind/security priority/high

#5 opened 2026-04-02 11:20:30 +02:00 by marcel

5

Sessions not invalidated on password/role change or deactivation kind/security priority/high

#4 opened 2026-04-02 11:20:25 +02:00 by marcel

5

Signup creates session but never authenticates the user kind/security priority/critical

#3 opened 2026-04-02 11:20:16 +02:00 by marcel

5