tinker_tickets

RecurringTicketModel::updateAfterRun() is dead code lacking the double-fire race guard of the method that replaced it dead-code priority/low

#90

by jared was closed 2026-09-08 20:46:42 -04:00

1

Re-enabling a paused recurring schedule fires immediately instead of resuming from 'now' priority/low ux

#89

by jared was closed 2026-09-08 20:46:42 -04:00

1

Recurring ticket: a creation failure after claiming a schedule silently and permanently loses that occurrence priority/medium reliability

#88

by jared was closed 2026-09-11 14:49:56 -04:00

1

Comment edits never appear on the ticket's own Activity Timeline — missing ticket_id in audit log details priority/medium reliability

#87

by jared was closed 2026-09-11 14:12:02 -04:00

1

CSRF resync updates the token but never auto-retries the failed request — every stale-token case surfaces a user-visible error first priority/medium ux

#86

by jared was closed 2026-09-11 13:48:33 -04:00

1

12 of ~16 hand-rolled CSRF checks omit csrf_token from their rejection response, breaking client-side resync app-wide priority/high security

#85

by jared was closed 2026-09-11 11:54:45 -04:00

1

In-app notification title formatter assumes every ticket update is a status change — breaks for title/priority/description/category/type/visibility edits notifications priority/high

#84

by jared was closed 2026-09-08 20:46:41 -04:00

1

Every Bearer API request unnecessarily starts a new PHP session performance priority/low

#83

by jared was closed 2026-09-11 14:12:01 -04:00

1

X-RateLimit-* response headers are misleading for Bearer/API-key clients priority/low rate-limiting

#82

by jared was closed 2026-09-11 14:12:00 -04:00

1

Bearer API endpoints are rate-limited purely by shared IP, not by API key — one key can starve another priority/medium rate-limiting security

#81

by jared was closed 2026-09-11 14:12:00 -04:00

1

RATE_LIMIT_DEFAULT/RATE_LIMIT_API config keys are dead — editing them in .env has zero effect config priority/medium rate-limiting

#80

by jared was closed 2026-09-11 14:12:00 -04:00

1

dashboard.js: dead code — write-only localStorage key and unused sortTable() function dead-code priority/low

#79

by jared was closed 2026-09-08 20:46:41 -04:00

1

Failed Matrix webhook posts are logged but never retried — confirm this best-effort design is intentional needs-decision notifications priority/low

#78

by jared was closed 2026-09-12 01:21:15 -04:00

1

Matrix webhook calls are synchronous with no connect-timeout — worst case ~30s added to a single comment's response time notifications performance priority/medium

#77

by jared was closed 2026-09-11 14:11:59 -04:00

1

Two different 'clear filters' controls clear disjoint sets — no single click fully resets the dashboard priority/medium ux

#76

by jared was closed 2026-09-08 21:18:22 -04:00

1

'Clear All Filters' button silently does nothing to any active date-range filter priority/medium ux

#75

by jared was closed 2026-09-08 20:46:40 -04:00

1

Bulk-operation audit_log entries use a different shape than every other status-change path, breaking the timeline and in-app notifications data-integrity notifications priority/medium

#74

by jared was closed 2026-09-11 12:44:17 -04:00

1

Watchers are never pruned when a ticket's visibility is tightened notifications priority/medium security

#73

by jared was closed 2026-09-11 13:48:32 -04:00

1

sendAssignmentNotification() has the same missing-visibility-check gap as #46 notifications priority/medium security

#72

by jared was closed 2026-09-11 11:27:08 -04:00

1

notifyWatchers() only half-redacts for non-public tickets — title and shared notify-list still leak notifications priority/medium security

#71

by jared was closed 2026-09-11 11:27:07 -04:00

1