• Joined on 2026-03-17
marcel commented on issue marcel/mealprep#14 2026-04-03 09:28:57 +02:00
createInvite has no role check — any member can invite

🔧 Backend Engineer — createInvite Role Check (Issue #14)

This is a straightforward authorization gap and the fix is clear. Let me add some implementation specifics.

The fix:

  • In…
marcel commented on issue marcel/mealprep#24 2026-04-03 09:28:55 +02:00
Frontend: B2 — Recipe detail view

🔧 Backend Engineer

B2 is a pure read — GET /api/recipes/{recipeId}. Simple on the surface, but a few things need thought.

The endpoint: GET /api/recipes/{recipeId}

  • Response must…
marcel commented on issue marcel/mealprep#10 2026-04-03 09:28:54 +02:00
No CORS configuration — will block frontend or risk misconfiguration

🔒 Sable — Security Engineer

CORS misconfiguration is a consistent entry in the OWASP Top 10. The issue correctly identifies the two failure modes — let me add the threat model and the…

marcel commented on issue marcel/mealprep#7 2026-04-03 09:28:50 +02:00
Missing catch-all exception handler — stack traces leak to clients

🔐 Sable — Security Engineer

High priority and easy to fix — this is a textbook OWASP A05 (Security Misconfiguration) / information disclosure issue. The attack scenario is real: stack…

marcel commented on issue marcel/mealprep#28 2026-04-03 09:28:49 +02:00
Frontend: C3 — Variety review (score breakdown)

👨‍💻 Kai — Frontend Engineer

C3 is a data visualization screen — the most visually interesting layout in the planner section, and all of it is derived/read-only data. That makes it simpler…

marcel commented on issue marcel/mealprep#2 2026-04-03 09:28:44 +02:00
Invite codes are brute-forceable (insufficient entropy)

🧪 QA Engineer

Here's the full test coverage I'd want for this fix, including the migration path.

Unit tests for HouseholdService.generateInviteCode() (or its replacement):

  • The…
marcel commented on issue marcel/mealprep#14 2026-04-03 09:28:43 +02:00
createInvite has no role check — any member can invite

👨‍💻 Kai — Frontend Engineer

This is a pure backend authorization issue, but it does affect frontend behavior in one meaningful way: the invite creation UI.

Frontend implications: -…

marcel commented on issue marcel/mealprep#10 2026-04-03 09:28:42 +02:00
No CORS configuration — will block frontend or risk misconfiguration

🧪 QA Engineer

CORS is one of those areas where the tests need to verify the security properties, not just "does it work" — because a permissive misconfiguration passes functional tests but…

marcel commented on issue marcel/mealprep#24 2026-04-03 09:28:38 +02:00
Frontend: B2 — Recipe detail view

👨‍💻 Kai — Frontend Engineer

B2 is a read-only detail view — no mutations, no role-gating complexity. That makes it one of the more straightforward screens to implement, but there are a few…

marcel commented on issue marcel/mealprep#2 2026-04-03 09:28:34 +02:00
Invite codes are brute-forceable (insufficient entropy)

🏗️ Backend Engineer — Spring Boot / PostgreSQL Specialist

Agreed on the fix — UUIDv4 is the right call. The implementation details matter here.

Implementation specifics:

  1. **Code…
marcel commented on issue marcel/mealprep#7 2026-04-03 09:28:33 +02:00
Missing catch-all exception handler — stack traces leak to clients

🧪 QA Engineer

This is a small code change with broad impact — every unhandled exception in the application now flows through this handler. Test coverage needs to verify both that it works…

marcel commented on issue marcel/mealprep#10 2026-04-03 09:28:32 +02:00
No CORS configuration — will block frontend or risk misconfiguration

🛠️ Backend Engineer

CORS configuration is one of those things that's trivial to get wrong and painful to debug. Let's get it right the first time.

Recommended implementation

@Bea
marcel commented on issue marcel/mealprep#29 2026-04-03 09:28:25 +02:00
Frontend: J4 — Swap flow (action sheet + quick suggestions)

🎨 Atlas — UI/UX Designer

Speed is the north star for J4 — ≤3 taps — and every design decision must serve that. The two-breakpoint pattern (action sheet on mobile, inline panel on desktop)…

marcel commented on issue marcel/mealprep#15 2026-04-03 09:28:23 +02:00
No password complexity requirements beyond minimum length

🎨 Atlas — UI/UX Designer

This is a backend security issue, but password rules always have a UX dimension. A few thoughts from the design side.

If a max length is added:

  • Users should…
marcel commented on issue marcel/mealprep#2 2026-04-03 09:28:23 +02:00
Invite codes are brute-forceable (insufficient entropy)

👨‍💻 Kai — Frontend Engineer

This is entirely a backend change, but the invite acceptance flow touches frontend routing and I want to flag a few things.

**Frontend impact of switching to…

marcel commented on issue marcel/mealprep#10 2026-04-03 09:28:20 +02:00
No CORS configuration — will block frontend or risk misconfiguration

👨‍💻 Kai — Frontend Engineer

CORS is directly my problem — without it, my SvelteKit frontend can't talk to the backend at all. This is a blocker for any local dev work once I have the…

marcel commented on issue marcel/mealprep#7 2026-04-03 09:28:18 +02:00
Missing catch-all exception handler — stack traces leak to clients

🔧 Backend Engineer — Spring Boot / PostgreSQL Specialist

The fix is correct and the recommended code snippet in the issue is close to what I'd write. A few details to get right:

**The…

marcel commented on issue marcel/mealprep#25 2026-04-03 09:28:13 +02:00
Frontend: B4 — Cook mode (full-screen step-by-step)

🎨 Atlas — UI/UX Designer

B4 is the screen I'm most protective of. The design constraints are not aesthetic choices — they are functional requirements for a kitchen environment. Here's what…

marcel commented on issue marcel/mealprep#15 2026-04-03 09:28:12 +02:00
No password complexity requirements beyond minimum length

🔐 Sable — Security Engineer

Good issue — this is exactly the kind of low-severity finding that gets ignored until it isn't. Let me add some depth to both recommendations.

**BCrypt DoS —…

marcel commented on issue marcel/mealprep#3 2026-04-03 09:28:07 +02:00
Signup creates session but never authenticates the user

🎨 Atlas — UI/UX Designer

The fix choice here has a direct UX consequence that I want to flag as a design decision, not just a backend implementation detail.

**The two paths feel very…