rbrooks/TeaLeaves

Watch

v7.1.0 - Core hardening & security

New issue

Pre-v8 must-fix: High-severity correctness/ops/UI findings, the federated-write trust-boundary security fixes, and recovery-critical reliability (backup restore, graceful shutdown). From the 2026-07-15 codebase audit. Rationale: harden and test the v7 federation boundary before stacking v8's moderation layer on it.

No due date

100% Completed

Roadmap: sequence a core-hardening pass before v8 and test the v7 federation trust boundary

#92 by claude-bot was closed 2026-07-16 22:05:11 +00:00 0 / 2

Deep links (invites, shared motifs) are lost through the login redirect

#91 by claude-bot was closed 2026-07-16 22:04:40 +00:00 0 / 2

QuickCapture silently discards a voice note recorded before the entry is saved

#90 by claude-bot was closed 2026-07-16 22:04:38 +00:00 0 / 1

Import, Suggestions, and Trash are unreachable on mobile

#89 by claude-bot was closed 2026-07-16 22:04:39 +00:00 0 / 1

PWA icon and favicon assets are missing - install prompt and tab icon are broken

#88 by claude-bot was closed 2026-07-16 19:03:57 +00:00 0 / 2

Run migrations before starting workers and the backup scheduler

#87 by claude-bot was closed 2026-07-16 22:04:31 +00:00 0 / 1

Backup spawns (restic/pg_dump) have no timeout - a hung repo silently stops all backups

#86 by claude-bot was closed 2026-07-16 22:04:37 +00:00 0 / 2

Add graceful shutdown - close BullMQ workers, HTTP server, and pools on SIGTERM

#85 by claude-bot was closed 2026-07-16 22:04:33 +00:00 0 / 2

Backup entry-restore is broken - INSERT omits NOT NULL project_id and uses invalid certainty

#84 by claude-bot was closed 2026-07-16 22:04:32 +00:00 0 / 2

nginx has no client_max_body_size - uploads/imports >1 MB get 413 through the proxy

#83 by claude-bot was closed 2026-07-16 19:03:56 +00:00 0 / 2

Bind HTTP-signature signer to activity.actor on all AP inbox activity types

#82 by claude-bot was closed 2026-07-16 21:24:04 +00:00 0 / 2

SSRF: unauthenticated AP inbox fetches attacker-controlled actor URLs with no private-IP guard

#81 by claude-bot was closed 2026-07-16 21:24:05 +00:00 0 / 3

Backup routes are not admin-gated - cloud credentials readable by any authenticated user

#80 by claude-bot was closed 2026-07-16 19:04:04 +00:00 0 / 3