2025-09-26 - 2026-09-26
Overview
48 Releases published by 1 user
Published
deploy-2026.09.26-272
Published
deploy-2026.09.25-268
Published
deploy-2026.09.25-264
Published
deploy-2026.09.24-258
Published
deploy-2026.09.24-254
Published
deploy-2026.09.12-242
Published
deploy-2026.09.12-238
Published
deploy-2026.09.12-234
Published
deploy-2026.09.12-230
Published
deploy-2026.09.12-226
Published
deploy-2026.09.12-222
Published
deploy-2026.09.11-218
Published
deploy-2026.09.11-214
Published
deploy-2026.09.11-210
Published
deploy-2026.09.11-206
Published
deploy-2026.09.11-202
Published
deploy-2026.09.11-198
Published
deploy-2026.09.11-194
Published
deploy-2026.09.11-190
Published
deploy-2026.09.11-186
Published
deploy-2026.09.09-182
Published
deploy-2026.09.09-178
Published
deploy-2026.09.08-172
Published
deploy-2026.09.01-163
Published
deploy-2026.08.08-155
Published
deploy-2026.08.08-151
Published
deploy-2026.08.08-147
Published
deploy-2026.08.08-143
Published
deploy-2026.08.08-139
Published
deploy-2026.07.15-130
Published
deploy-2026.07.15-122
Published
deploy-2026.07.11-107
Published
deploy-2026.06.30-96
Published
deploy-2026.06.30-92
Published
deploy-2026.06.30-88
Published
deploy-2026.06.30-84
Published
deploy-2026.06.30-80
Published
deploy-2026.06.30-76
Published
deploy-2026.06.30-72
Published
deploy-2026.06.30-68
Published
deploy-2026.04.29-49
Published
deploy-2026.04.29-41
Published
deploy-2026.04.18-35
Published
deploy-2026.04.16-31
Published
deploy-2026.04.16-27
Published
deploy-2026.04.16-23
Published
deploy-2026.04.16-11
Published
deploy-2026.04.14-9
3 Pull requests merged by 1 user
Merged
#26 Bearer API extension: list/read/comment/close + key scopes
Merged
#25 Ship CSRF-drift + markdown fixes to production
Merged
#24 Fix bugs across data layer, API, frontend, ops (multi-agent review)
108 Issues closed from 1 user
Closed
#113 MCP: ticket links (dependencies/duplicates) and similar-ticket search
Closed
#112 Ticket pages are giving a 500, maybe due to the mcp server deployment?
Closed
#111 Remote MCP server with OAuth (Authelia) so Claude Code can use Tinker Tickets as the signed-in user
Closed
#78 Failed Matrix webhook posts are logged but never retried — confirm this best-effort design is intentional
Closed
#70 Bearer read-scope API keys bypass ticket visibility entirely — confirm this is an intentional, documented decision
Closed
#93 Watch/unwatch actions are never logged to audit_log
Closed
#95 LDAP bind credentials transmitted in plaintext (no TLS)
Closed
#110 chartStatus should be reworked to be just currently open, pending, in progress tickets as a breakdown as over time closed will take up 99% of it.
Closed
#49 User Activity report: "Tickets Assigned" column filters by ticket creation date, not assignment date
Closed
#98 Attachment 'thumbnails' are the full-size original image — no actual resized thumbnail is ever generated
Closed
#33 Bulk operations aren't actually atomic despite the docblock claiming so
Closed
#36 Bulk-action buttons have no double-submit guard
Closed
#34 Bulk operations: TOCTOU race on ticket status used for workflow validation
Closed
#35 create_ticket_api.php: dedup/escalation race can duplicate notifications or drop a real escalation
Closed
#37 Required-comment status-change flow isn't transactional (client and server)
Closed
#109 No toolbar button inserts table syntax, despite README describing table rendering as a feature
Closed
#43 base.js: unused lt.markdown module has no URL-protocol allowlist on links — latent stored-XSS trap
Closed
#44 ESLint: ~20 empty catch blocks and ~6 loose equality comparisons in assets/js/
Closed
#45 README.md Project Structure tree is stale (missing error views, config/requirements.php, migration 001)
Closed
#108 No debounce on the live markdown preview — full parser re-runs on every keystroke
Closed
#62 Workflow Designer allows duplicate transition rows that silently override each other non-deterministically
Closed
#88 Recurring ticket: a creation failure after claiming a schedule silently and permanently loses that occurrence
Closed
#58 Advanced Search silently drops filters it doesn't represent, on submit
Closed
#87 Comment edits never appear on the ticket's own Activity Timeline — missing ticket_id in audit log details
Closed
#83 Every Bearer API request unnecessarily starts a new PHP session
Closed
#80 RATE_LIMIT_DEFAULT/RATE_LIMIT_API config keys are dead — editing them in .env has zero effect
Closed
#81 Bearer API endpoints are rate-limited purely by shared IP, not by API key — one key can starve another
Closed
#82 X-RateLimit-* response headers are misleading for Bearer/API-key clients
Closed
#77 Matrix webhook calls are synchronous with no connect-timeout — worst case ~30s added to a single comment's response time
Closed
#86 CSRF resync updates the token but never auto-retries the failed request — every stale-token case surfaces a user-visible error first
Closed
#57 Notification bell uses raw fetch() instead of lt.api, breaking CSRF token resync
Closed
#73 Watchers are never pruned when a ticket's visibility is tightened
Closed
#48 api/notifications.php: in-app notifications don't re-check current ticket visibility
Closed
#50 Custom field values have no server-side validation against field_type or select options
Closed
#47 Custom Fields feature is entirely disconnected from ticket creation/editing/viewing
Closed
#68 hwmonDaemon 'reopen closed duplicate' path bypasses Workflow Designer validation entirely via raw SQL
Closed
#74 Bulk-operation audit_log entries use a different shape than every other status-change path, breaking the timeline and in-app notifications
Closed
#67 Bulk operations never fire Matrix/watcher notifications for status changes
Closed
#56 Stale sessions never re-sync privileges from Authelia (revoked admin keeps access up to 5h)
Closed
#105 App has no styled 500/fatal-error page — ErrorHandler is wired into essentially nothing
Closed
#38 ErrorHandler.php documented as global but only wired into 1 of 33 API endpoints
Closed
#39 13 of 33 API endpoints never disable display_errors — potential stack-trace leak
Closed
#85 12 of ~16 hand-rolled CSRF checks omit csrf_token from their rejection response, breaking client-side resync app-wide
Closed
#94 TRUSTED_PROXIES ships empty/disabled by default — full admin-impersonation risk if not explicitly configured
Closed
#103 index.php and create_ticket_api.php use their own raw mysqli connections instead of Database::getConnection() — missing charset/timezone sync on most page traffic
Closed
#104 DB connection failure leaks raw mysqli error text to any unauthenticated visitor
Closed
#72 sendAssignmentNotification() has the same missing-visibility-check gap as #46
Closed
#69 @mention notifications leak confidential/internal ticket content to users with no access — worse than #46
Closed
#71 notifyWatchers() only half-redacts for non-public tickets — title and shared notify-list still leak
Closed
#46 Confidential/internal ticket titles leak to Matrix on create/status-change (NotificationHelper missing visibility check)
Closed
#32 ticket_watchers: ticket_id type mismatch (int vs varchar) and missing FK to tickets
Closed
#27 create_ticket_api.php: no rate limiting on external Bearer-key endpoint
Closed
#28 TicketModel: visibility-filter group matching disagrees with single-ticket access check
Closed
#30 migrate.php: transaction wrapping around DDL is illusory, failed migration can wedge the runner
Closed
#64 SLA priority-alert banner doesn't update when priority changes without a page reload
Closed
#99 download_attachment.php has no HTTP Range/partial-content support
Closed
#100 Attachment listing is completely unpaginated
Closed
#76 Two different 'clear filters' controls clear disjoint sets — no single click fully resets the dashboard
Closed
#101 Dashboard stats/chart minor cleanup: missing empty-state message, dead duplicate click-handler, dead computed field
Closed
#102 Dashboard 'Quick Assign' is completely non-functional — wrong callback contract
Closed
#106 Requirements checker never verifies memory_limit/max_execution_time are set to sane values
Closed
#107 Markdown toolbar buttons clear the textarea's native undo/redo history
Closed
#92 README Dev Note #24's StatsModel invalidation caller list is missing an 8th caller (documentation gap, behavior is correct)
Closed
#96 Concurrent first-time logins for a brand-new user can throw an uncaught exception
Closed
#97 Image attachments retain EXIF metadata (including GPS location) — served back verbatim to any user with ticket access
Closed
#89 Re-enabling a paused recurring schedule fires immediately instead of resuming from 'now'
Closed
#90 RecurringTicketModel::updateAfterRun() is dead code lacking the double-fire race guard of the method that replaced it
Closed
#91 StatsModel: narrow dogpile cache-overwrite race can extend stale stats up to another full TTL after invalidation
Closed
#79 dashboard.js: dead code — write-only localStorage key and unused sortTable() function
Closed
#84 In-app notification title formatter assumes every ticket update is a status change — breaks for title/priority/description/category/type/visibility edits
Closed
#65 Kanban drag-and-drop has no touch-event fallback — unusable on mobile despite README's "Touch-friendly controls" claim
Closed
#66 cleanup_audit_log.php: unbounded single-statement DELETE risks lock contention on a large backlog
Closed
#75 'Clear All Filters' button silently does nothing to any active date-range filter
Closed
#60 Attachment thumbnail decision uses filename extension instead of server-verified MIME type
Closed
#61 Advanced Search priority range and date range have no min≤max validation
Closed
#63 .env.example is missing 5 environment variables that config.php reads and README documents
Closed
#54 helpers/OutputHelper.php is dead code despite being documented as part of the security architecture
Closed
#55 No per-ticket or per-user attachment count/storage quota
Closed
#59 Notification bell polling ignores tab visibility and has no backoff
Closed
#52 User Activity report: "Last Activity" column ignores the selected date-range filter
Closed
#53 CreateTicketView.php uses raw browser confirm() instead of the project's showConfirmModal() convention
Closed
#41 Collation inconsistency: saved_filters and ticket_attachments use utf8mb4_unicode_ci instead of the documented utf8mb4_general_ci convention
Closed
#42 api/get_users.php: unrestricted user enumeration, no pagination or admin gate
Closed
#51 Ticket dependency duplicate-check misses the semantic inverse relationship
Closed
#29 Dashboard chart click-to-filter discards other active filters
Closed
#31 Avatar color hash has drifted between PHP (crc32) and JS (custom hash) — same user shows different colors
Closed
#40 Inconsistent FK ON DELETE behavior: bulk_operations.performed_by and ticket_templates.created_by default to RESTRICT
Closed
#18 comment markdown not saving post reload sometimes
Closed
#20 when closing a ticket and it asks for a comment, if you just close the modal then it still closes the ticket without a comment on the screen until you refresh where it then shows it still open.
Closed
#21 When changing the status of a ticket from the bulk edit dashboard it doesn't take the workflow designer into account such as requiring a comment etc..
Closed
#22 When selecting the bars in the charts on the dashboard it should filter the page to that statistic
Closed
#23 the on hover of a ticket id while on the dashboard in light mode shows in dark mode.
Closed
#19 status change dropdown in lightmode shows as darkmode
Closed
#16 Comment edit icon should only show for the owner of said comment
Closed
#15 Comment delete icon should only show for admins
Closed
#17 Swap all discord notifications to matrix webhook notifications
Closed
#14 links are still showing in discord webhooks as localhost.
Closed
#13 No option to assign to a user when creating a new ticket
Closed
#12 discord links use localhost
Closed
#11 Cannot scroll in ticket overview's
Closed
#7 markdown comments do not support tables natively in codeblocks or out of them.
Closed
#10 Links should be clickable no matter if markdown is enabled or not.
Closed
#9 mobile ui is visible on desktop, also mobile ui sucks really bad
Closed
#8 able to edit and delete comments
Closed
#6 preview markdown does not work
Closed
#5 unable to close a ticket
Closed
#4 In Progress, status overflow due to min width possibly
Closed
#3 Variable css on ticket search results below search bar
106 Issues created by 0 users
Opened
#5 unable to close a ticket
Opened
#6 preview markdown does not work
Opened
#7 markdown comments do not support tables natively in codeblocks or out of them.
Opened
#8 able to edit and delete comments
Opened
#9 mobile ui is visible on desktop, also mobile ui sucks really bad
Opened
#10 Links should be clickable no matter if markdown is enabled or not.
Opened
#11 Cannot scroll in ticket overview's
Opened
#12 discord links use localhost
Opened
#13 No option to assign to a user when creating a new ticket
Opened
#14 links are still showing in discord webhooks as localhost.
Opened
#15 Comment delete icon should only show for admins
Opened
#16 Comment edit icon should only show for the owner of said comment
Opened
#17 Swap all discord notifications to matrix webhook notifications
Opened
#18 comment markdown not saving post reload sometimes
Opened
#19 status change dropdown in lightmode shows as darkmode
Opened
#20 when closing a ticket and it asks for a comment, if you just close the modal then it still closes the ticket without a comment on the screen until you refresh where it then shows it still open.
Opened
#21 When changing the status of a ticket from the bulk edit dashboard it doesn't take the workflow designer into account such as requiring a comment etc..
Opened
#22 When selecting the bars in the charts on the dashboard it should filter the page to that statistic
Opened
#23 the on hover of a ticket id while on the dashboard in light mode shows in dark mode.
Opened
#27 create_ticket_api.php: no rate limiting on external Bearer-key endpoint
Opened
#28 TicketModel: visibility-filter group matching disagrees with single-ticket access check
Opened
#29 Dashboard chart click-to-filter discards other active filters
Opened
#30 migrate.php: transaction wrapping around DDL is illusory, failed migration can wedge the runner
Opened
#31 Avatar color hash has drifted between PHP (crc32) and JS (custom hash) — same user shows different colors
Opened
#32 ticket_watchers: ticket_id type mismatch (int vs varchar) and missing FK to tickets
Opened
#33 Bulk operations aren't actually atomic despite the docblock claiming so
Opened
#34 Bulk operations: TOCTOU race on ticket status used for workflow validation
Opened
#35 create_ticket_api.php: dedup/escalation race can duplicate notifications or drop a real escalation
Opened
#36 Bulk-action buttons have no double-submit guard
Opened
#37 Required-comment status-change flow isn't transactional (client and server)
Opened
#38 ErrorHandler.php documented as global but only wired into 1 of 33 API endpoints
Opened
#39 13 of 33 API endpoints never disable display_errors — potential stack-trace leak
Opened
#40 Inconsistent FK ON DELETE behavior: bulk_operations.performed_by and ticket_templates.created_by default to RESTRICT
Opened
#41 Collation inconsistency: saved_filters and ticket_attachments use utf8mb4_unicode_ci instead of the documented utf8mb4_general_ci convention
Opened
#42 api/get_users.php: unrestricted user enumeration, no pagination or admin gate
Opened
#43 base.js: unused lt.markdown module has no URL-protocol allowlist on links — latent stored-XSS trap
Opened
#44 ESLint: ~20 empty catch blocks and ~6 loose equality comparisons in assets/js/
Opened
#45 README.md Project Structure tree is stale (missing error views, config/requirements.php, migration 001)
Opened
#46 Confidential/internal ticket titles leak to Matrix on create/status-change (NotificationHelper missing visibility check)
Opened
#47 Custom Fields feature is entirely disconnected from ticket creation/editing/viewing
Opened
#48 api/notifications.php: in-app notifications don't re-check current ticket visibility
Opened
#49 User Activity report: "Tickets Assigned" column filters by ticket creation date, not assignment date
Opened
#50 Custom field values have no server-side validation against field_type or select options
Opened
#51 Ticket dependency duplicate-check misses the semantic inverse relationship
Opened
#52 User Activity report: "Last Activity" column ignores the selected date-range filter
Opened
#53 CreateTicketView.php uses raw browser confirm() instead of the project's showConfirmModal() convention
Opened
#54 helpers/OutputHelper.php is dead code despite being documented as part of the security architecture
Opened
#55 No per-ticket or per-user attachment count/storage quota
Opened
#56 Stale sessions never re-sync privileges from Authelia (revoked admin keeps access up to 5h)
Opened
#57 Notification bell uses raw fetch() instead of lt.api, breaking CSRF token resync
Opened
#58 Advanced Search silently drops filters it doesn't represent, on submit
Opened
#59 Notification bell polling ignores tab visibility and has no backoff
Opened
#60 Attachment thumbnail decision uses filename extension instead of server-verified MIME type
Opened
#61 Advanced Search priority range and date range have no min≤max validation
Opened
#62 Workflow Designer allows duplicate transition rows that silently override each other non-deterministically
Opened
#63 .env.example is missing 5 environment variables that config.php reads and README documents
Opened
#64 SLA priority-alert banner doesn't update when priority changes without a page reload
Opened
#65 Kanban drag-and-drop has no touch-event fallback — unusable on mobile despite README's "Touch-friendly controls" claim
Opened
#66 cleanup_audit_log.php: unbounded single-statement DELETE risks lock contention on a large backlog
Opened
#67 Bulk operations never fire Matrix/watcher notifications for status changes
Opened
#68 hwmonDaemon 'reopen closed duplicate' path bypasses Workflow Designer validation entirely via raw SQL
Opened
#69 @mention notifications leak confidential/internal ticket content to users with no access — worse than #46
Opened
#70 Bearer read-scope API keys bypass ticket visibility entirely — confirm this is an intentional, documented decision
Opened
#71 notifyWatchers() only half-redacts for non-public tickets — title and shared notify-list still leak
Opened
#72 sendAssignmentNotification() has the same missing-visibility-check gap as #46
Opened
#73 Watchers are never pruned when a ticket's visibility is tightened
Opened
#74 Bulk-operation audit_log entries use a different shape than every other status-change path, breaking the timeline and in-app notifications
Opened
#75 'Clear All Filters' button silently does nothing to any active date-range filter
Opened
#76 Two different 'clear filters' controls clear disjoint sets — no single click fully resets the dashboard
Opened
#77 Matrix webhook calls are synchronous with no connect-timeout — worst case ~30s added to a single comment's response time
Opened
#78 Failed Matrix webhook posts are logged but never retried — confirm this best-effort design is intentional
Opened
#79 dashboard.js: dead code — write-only localStorage key and unused sortTable() function
Opened
#80 RATE_LIMIT_DEFAULT/RATE_LIMIT_API config keys are dead — editing them in .env has zero effect
Opened
#81 Bearer API endpoints are rate-limited purely by shared IP, not by API key — one key can starve another
Opened
#82 X-RateLimit-* response headers are misleading for Bearer/API-key clients
Opened
#83 Every Bearer API request unnecessarily starts a new PHP session
Opened
#84 In-app notification title formatter assumes every ticket update is a status change — breaks for title/priority/description/category/type/visibility edits
Opened
#85 12 of ~16 hand-rolled CSRF checks omit csrf_token from their rejection response, breaking client-side resync app-wide
Opened
#86 CSRF resync updates the token but never auto-retries the failed request — every stale-token case surfaces a user-visible error first
Opened
#87 Comment edits never appear on the ticket's own Activity Timeline — missing ticket_id in audit log details
Opened
#88 Recurring ticket: a creation failure after claiming a schedule silently and permanently loses that occurrence
Opened
#89 Re-enabling a paused recurring schedule fires immediately instead of resuming from 'now'
Opened
#90 RecurringTicketModel::updateAfterRun() is dead code lacking the double-fire race guard of the method that replaced it
Opened
#91 StatsModel: narrow dogpile cache-overwrite race can extend stale stats up to another full TTL after invalidation
Opened
#92 README Dev Note #24's StatsModel invalidation caller list is missing an 8th caller (documentation gap, behavior is correct)
Opened
#93 Watch/unwatch actions are never logged to audit_log
Opened
#94 TRUSTED_PROXIES ships empty/disabled by default — full admin-impersonation risk if not explicitly configured
Opened
#95 LDAP bind credentials transmitted in plaintext (no TLS)
Opened
#96 Concurrent first-time logins for a brand-new user can throw an uncaught exception
Opened
#97 Image attachments retain EXIF metadata (including GPS location) — served back verbatim to any user with ticket access
Opened
#98 Attachment 'thumbnails' are the full-size original image — no actual resized thumbnail is ever generated
Opened
#99 download_attachment.php has no HTTP Range/partial-content support
Opened
#100 Attachment listing is completely unpaginated
Opened
#101 Dashboard stats/chart minor cleanup: missing empty-state message, dead duplicate click-handler, dead computed field
Opened
#102 Dashboard 'Quick Assign' is completely non-functional — wrong callback contract
Opened
#103 index.php and create_ticket_api.php use their own raw mysqli connections instead of Database::getConnection() — missing charset/timezone sync on most page traffic
Opened
#104 DB connection failure leaks raw mysqli error text to any unauthenticated visitor
Opened
#105 App has no styled 500/fatal-error page — ErrorHandler is wired into essentially nothing
Opened
#106 Requirements checker never verifies memory_limit/max_execution_time are set to sane values
Opened
#107 Markdown toolbar buttons clear the textarea's native undo/redo history
Opened
#108 No debounce on the live markdown preview — full parser re-runs on every keystroke
Opened
#109 No toolbar button inserts table syntax, despite README describing table rendering as a feature
Opened
#110 chartStatus should be reworked to be just currently open, pending, in progress tickets as a breakdown as over time closed will take up 99% of it.
Opened
#111 Remote MCP server with OAuth (Authelia) so Claude Code can use Tinker Tickets as the signed-in user
Opened
#112 Ticket pages are giving a 500, maybe due to the mcp server deployment?
Opened
#113 MCP: ticket links (dependencies/duplicates) and similar-ticket search