Issues - tinker_tickets - Lotus Git Server

LotusGuild/tinker_tickets

Labels Milestones New Issue

Bearer read-scope API keys bypass ticket visibility entirely — confirm this is an intentional, documented decision needs-decision priority/high security

by jared was closed 2026-09-12 01:21:14 -04:00

@mention notifications leak confidential/internal ticket content to users with no access — worse than #46 notifications priority/high security

by jared was closed 2026-09-11 11:27:07 -04:00

hwmonDaemon 'reopen closed duplicate' path bypasses Workflow Designer validation entirely via raw SQL priority/high security workflow

by jared was closed 2026-09-11 12:44:17 -04:00

Bulk operations never fire Matrix/watcher notifications for status changes notifications priority/high

by jared was closed 2026-09-11 12:44:16 -04:00

cleanup_audit_log.php: unbounded single-statement DELETE risks lock contention on a large backlog performance priority/low

by jared was closed 2026-09-08 20:46:40 -04:00

Kanban drag-and-drop has no touch-event fallback — unusable on mobile despite README's "Touch-friendly controls" claim priority/medium ux

by jared was closed 2026-09-08 20:46:40 -04:00

SLA priority-alert banner doesn't update when priority changes without a page reload priority/medium ux

by jared was closed 2026-09-08 21:18:23 -04:00

.env.example is missing 5 environment variables that config.php reads and README documents documentation priority/medium

by jared was closed 2026-09-08 20:46:39 -04:00

Workflow Designer allows duplicate transition rows that silently override each other non-deterministically data-integrity priority/medium workflow

by jared was closed 2026-09-11 14:49:56 -04:00

Advanced Search priority range and date range have no min≤max validation priority/low ux

by jared was closed 2026-09-08 20:46:39 -04:00

Attachment thumbnail decision uses filename extension instead of server-verified MIME type priority/low ux

by jared was closed 2026-09-08 20:46:39 -04:00

Notification bell polling ignores tab visibility and has no backoff performance priority/low

by jared was closed 2026-09-08 20:46:38 -04:00

Advanced Search silently drops filters it doesn't represent, on submit priority/medium ux

by jared was closed 2026-09-11 14:49:55 -04:00

Notification bell uses raw fetch() instead of lt.api, breaking CSRF token resync priority/medium ux

by jared was closed 2026-09-11 13:48:32 -04:00

Stale sessions never re-sync privileges from Authelia (revoked admin keeps access up to 5h) priority/high security

by jared was closed 2026-09-11 12:24:00 -04:00

No per-ticket or per-user attachment count/storage quota priority/low security

by jared was closed 2026-09-08 20:46:38 -04:00

helpers/OutputHelper.php is dead code despite being documented as part of the security architecture dead-code documentation priority/low

by jared was closed 2026-09-08 20:46:38 -04:00

CreateTicketView.php uses raw browser confirm() instead of the project's showConfirmModal() convention priority/low ux

by jared was closed 2026-09-08 20:46:37 -04:00

User Activity report: "Last Activity" column ignores the selected date-range filter priority/low reliability

by jared was closed 2026-09-08 20:46:37 -04:00

Ticket dependency duplicate-check misses the semantic inverse relationship data-integrity priority/medium

by jared was closed 2026-09-08 20:46:36 -04:00

1 2 3 4 5 ...