Issues - null/BillTracker - Dream

New Issue

LOW: LIVE constant interpolated into SQL queries in payments.js

#81 by null was closed 2026-06-03 22:28:28 -05:00

MEDIUM: CSRF cookie defaults to httpOnly=false - XSS bypasses CSRF protection

priority:medium

#80 by null was closed 2026-05-31 15:55:29 -05:00

MEDIUM: Admin routes use req.params.id without integer validation

priority:medium

#79 by null was closed 2026-06-03 20:00:05 -05:00

MEDIUM: 10x .catch(() => {}) silently swallowing errors in client code

priority:medium

#76 by null was closed 2026-05-31 14:24:28 -05:00

MEDIUM: Floating-point REAL type for monetary amounts in SQLite

priority:medium

#75 by null was closed 2026-05-31 14:00:35 -05:00

HIGH: No explicit JSON body size limit on express.json() - default 100KB

#74 by null was closed 2026-05-31 13:23:15 -05:00

HIGH: No process-level unhandledRejection/uncaughtException handler

#73 by null was closed 2026-05-31 13:14:17 -05:00

HIGH: Payment UPDATE/DELETE lack user_id in WHERE clause (defense-in-depth)

#72 by null was closed 2026-05-31 13:12:16 -05:00

HIGH: SQL injection surface in analyticsService.js - string interpolation in WHERE clause

#71 by null was closed 2026-05-31 13:09:22 -05:00

CRITICAL: Incomplete user deletion - orphaned data risk

priority:critical

#70 by null was closed 2026-05-31 13:07:18 -05:00

CRITICAL: SMTP password stored in plaintext in SQLite

priority:critical

#69 by null was closed 2026-05-31 12:56:35 -05:00

CRITICAL: Async route handlers lack try/catch - unhandled rejections crash process

priority:critical

#68 by null was closed 2026-05-31 12:46:13 -05:00

Calendar shows Due dot on days with no bills due (e.g. Saturday 16th)

priority:medium

#64 by null was closed 2026-06-03 19:49:17 -05:00

Analytics — Expense vs Spend color key partially covered by bar graph on desktop

priority:medium

#62 by null was closed 2026-06-03 19:50:09 -05:00

Imported payments don't update debt balance (balance_delta always NULL)

priority:critical

#49 by null was closed 2026-06-03 22:16:44 -05:00 0 / 6

Authentik logo not displaying correctly on login/admin page — corrected file location

#36 by null was closed 2026-05-16 10:46:21 -05:00