Issues

• Missing CSRF protection on stateful cookie-based authentication endpoints

  geturbackend/urBackend#379 · Filter by author anshul23102 opened on Jul 31, 2026
  4

• Prevent internal error details from reaching API clients and add safe Kiroo replay IDs

  geturbackend/urBackend#378 · Filter by author anshul23102 opened on Jul 31, 2026
  7

• Refresh token family not invalidated on suspected theft (no token rotation chain revocation)

  geturbackend/urBackend#377 · Filter by author anshul23102 opened on Jul 31, 2026
  1

• Login brute-force lockout only tracks per-account; IP rotation bypasses it completely

  geturbackend/urBackend#376 · Filter by author anshul23102 opened on Jul 31, 2026
  1

• Social OAuth authorization code (rtCode) transmitted as URL query parameter

  geturbackend/urBackend#375 · Filter by author anshul23102 opened on Jul 31, 2026
  1

• Bug: No JSON body size limit enables memory-exhaustion DoS

  geturbackend/urBackend#356 · Filter by author Siddh2024 opened on Jul 11, 2026
  2

  

• Security: No helmet security headers — missing CSP, X-Frame-Options, HSTS

  geturbackend/urBackend#355 · Filter by author Siddh2024 opened on Jul 11, 2026
  1

• [SECURITY] No request size limiting on API endpoints - DoS vulnerability

  geturbackend/urBackend#331 · Filter by author Siddh2024 opened on Jun 20, 2026
  14

• [Bug] public-api: bulk insert endpoint silently injects isDeleted/deletedAt fields into validated data after stripping them

  geturbackend/urBackend#287 · Filter by author Kirtan-pc opened on Jun 7, 2026
  5

• [SECURITY] Add IP allowlist/denylist per project — restrict API access to specific IP ranges for enhanced access control

  geturbackend/urBackend#280 · Filter by author Abhushan187 opened on Jun 6, 2026
  3

• [FEATURE] Add collection-level data validation rules — enforce schema constraints (min/max length, regex, required fields) before insert/update

  geturbackend/urBackend#279 · Filter by author Abhushan187 opened on Jun 6, 2026
  3

• [Bug] public-api: updateSingleData quota check is susceptible to TOCTOU race — concurrent updates can collectively exceed the database limit

  geturbackend/urBackend#260 · Filter by author anshul23102 opened on Jun 2, 2026
  3

• [Bug] public-api: rate limiter sets validate.trustProxy: false but app.set('trust proxy', 1) is not applied, causing all cloud-deployed clients to share one rate-limit bucket

  geturbackend/urBackend#248 · Filter by author anshul23102 opened on Jun 1, 2026
  11

  

• [nsoc] Comprehensive Code Audit: 50 Bugs and 40 Architectural Features

  geturbackend/urBackend#187 · Filter by author jeeva5655 opened on May 21, 2026
  15

• chore: follow-up cleanups from PR #153 (collectionsLoading reset + dep scoping)

  geturbackend/urBackend#155 · Filter by author coderabbitai opened on May 7, 2026
  

• Add test coverage for existing-unverified-user OTP branch in signup

  level1nsoc26
  geturbackend/urBackend#144 · Filter by author coderabbitai opened on May 3, 2026
  3

  

• Add embedding generation and vector store integration for RAG pipeline

  geturbackend/urBackend#123 · Filter by author alok-kumar0421 opened on Apr 21, 2026
  3