All issues

[Security] Change-password endpoint downgrades bcrypt cost to 10 and has no rate limiting

#384

· MOHITKOURAV01 opened

on Aug 10, 2026

[Bug] GET /api/connections still lists blocked users and runs three unbounded queries

#383

· MOHITKOURAV01 opened

on Aug 10, 2026

[Bug] Meetup checklist API writes unvalidated input to the database and has no DELETE — items cannot be removed

#382

· MOHITKOURAV01 opened

on Aug 10, 2026

[Bug] GET /api/notifications returns every notification ever created — unpaginated, includes expired rows, and cannot be cleared

#381

· MOHITKOURAV01 opened

on Aug 10, 2026

[Security] GET /api/users leaks every user's email address and allows account enumeration via ?search=

#380

· MOHITKOURAV01 opened

on Aug 10, 2026

[Bug] Local timezone offset mismatch causes invalid DTEND in calendar ICS exports

#375

· Pratyush-Panda-2006 opened

on Aug 9, 2026

[Bug] Soft-deleted user accounts (isDeleted: true) can still view and update profile data

#374

· Pratyush-Panda-2006 opened

on Aug 9, 2026

[Bug] Profile avatar upload orphans old images on Cloudinary without cleanup

#373

· Pratyush-Panda-2006 opened

on Aug 9, 2026

[Security] Missing rate limiting on password reset confirmation endpoint (/api/auth/reset-password)

#372

· Pratyush-Panda-2006 opened

on Aug 9, 2026

[Bug] Profile PATCH endpoint throws PrismaClientValidationError when socialLinks is passed as an object

#371

· Pratyush-Panda-2006 opened

on Aug 9, 2026

[Security] allowDangerousEmailAccountLinking enables pre-registration account linking

#370

· vedant7007 opened

on Aug 9, 2026

[Bug] GET /api/matches sends a self-notification on every filter change (notification spam)

#369

· vedant7007 opened

on Aug 9, 2026