Files

Jakub Zych aa8ff53c0c docs(14): record code review disposition

2026-10-04 03:05:31 +02:00

phase, review, titles, findings, open, total, recorded

phase

review

titles

findings

open

total

recorded

14-REVIEW.md

json

id	severity	disposition	title
CR-01	critical	open	Album writes after slow Discogs I/O save every column from a stale struct, silently reverting concurrent edits

id	severity	disposition	title
WR-01	warning	open	A stale CSV match pass can cancel, advance or fork a remapped import (the race D-10 claims to close)

id	severity	disposition	title
WR-02	warning	open	The anonymous feedback upload keeps an attacker-chosen file extension in public storage

id	severity	disposition	title
WR-03	warning	open	Credential-test routes are unthrottled oracles for third-party keys (parity security hole)

id	severity	disposition	title
WR-04	warning	open	The "write-only" admin AI key can be redirected to any host by changing base_url

id	severity	disposition	title
WR-05	warning	open	`golem:import-settings` silently drops models from a repeater saved with non-sequential keys

id	severity	disposition	title
WR-06	warning	open	The G15Office sync job is not idempotent, and a retry files duplicate tasks

id	severity	disposition	title
IN-01	info	open	sunscreen does not scrub the Discogs token shape or struct fields

id	severity	disposition	title
IN-02	info	open	tide sidecar masking accepts a partly masked credential and prints two unredacted URLs

id	severity	disposition	title
IN-03	info	open	The match job's re-dispatch delay overflows on a huge Retry-After

id	severity	disposition	title
IN-04	info	open	`security.AllowedHosts` ignores a string-valued config key

id	severity	disposition	title
IN-05	info	open	The G15Office task id from the response is concatenated into the request path unescaped

id	severity	disposition	title
IN-06	info	open	embed.js `escapeHtml` is used in attribute context without escaping quotes (parity)

id	severity	disposition	title
IN-07	info	open	Job cancellation inside the mapping and cancel transactions is not rolled back with them

id	severity	disposition	title
IN-08	info	open	`wishlistReleaseMatchRules` aliases `releaseMatchRules`' backing array

2026-10-04T01:05:31.197Z

Phase 14: Code Review Disposition

Finding	Severity	Disposition	Source
CR-01	critical	open	-
WR-01	warning	open	-
WR-02	warning	open	-
WR-03	warning	open	-
WR-04	warning	open	-
WR-05	warning	open	-
WR-06	warning	open	-
IN-01	info	open	-
IN-02	info	open	-
IN-03	info	open	-
IN-04	info	open	-
IN-05	info	open	-
IN-06	info	open	-
IN-07	info	open	-
IN-08	info	open	-

Dispositions: open (recorded, not yet triaged), fixed, skipped, deferred.