All issues

Search results

[Wave 200pts] DOCS: .env.example omits several environment variables the app's own config schema requires, including a security-relevant one

backend

docs

Status: Open.

#1160 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] FIX: Wallet currency validation whitelist excludes XLM, the native Stellar asset this platform is built around

backend

fix

Status: Open.

#1159 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] SECURITY: Geo-restriction middleware is fully implemented but never applied to any route, and trusts a spoofable client header

backend

security

Status: Open.

#1158 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] SECURITY: GlobalExceptionFilter's sensitive-field redaction list doesn't match the actual field names used by auth/API DTOs, leaking credentials into logs

backend

security

Status: Open.

#1157 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] CHORE: src/modules/transactions/contorllers directory name is a typo for 'controllers'

backend

chore

Status: Open.

#1156 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] FIX: Inconsistent api/v1 route prefixing: 30 controllers hardcode the prefix while the global prefix is also applied, doubling their routes

backend

fix

Status: Open.

#1155 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] FIX: main.ts declares the same const port variable twice in the same function scope, a compile error

backend

fix

Status: Open.

#1154 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] CHORE: Jest coverage thresholds are a minimal global-only gate, contradicting CONTRIBUTING.md's claim of enforced high-risk-module thresholds

backend

chore

Status: Open.

#1153 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] SECURITY: GraphQL user query resolver returns any user's PII and KYC status by raw ID with no ownership or admin scoping

backend

security

Status: Open.

#1152 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] FEAT: Organisation entities exist with no module, service, or controller — the multi-user/business account feature is entirely unimplemented

backend

feature

Status: Open.

#1151 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] FIX: ScheduledJobsService auto-fails timed-out pending transactions without refunding the wallet balance already debited

backend

fix

Status: Open.

#1150 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026

[Wave 200pts] CHORE: Three tiny top-level service files (TransactionCategoryService, TransactionNotificationService, AdminMetricsService) are never registered in any module

backend

chore

Status: Open.

#1149 In Nexacore-Org/NexaFx-js;

· portableDD opened on Aug 21, 2026