vernier

#170 by rosa was closed 2026-08-10 01:41:28 +00:00

ops: set an explicit SMTP connect/read timeout instead of trusting lettre defaults

kind

bug

workflow

ready-for-agent

#163 by rosa was closed 2026-08-12 02:13:14 +00:00

ops: bound the apalis job-store pool — no acquire/busy timeout or connection cap

#162 by rosa was closed 2026-08-10 15:24:10 +00:00

ops: sweep expired confirmations, authorization codes, and invites

#160 by rosa was closed 2026-08-10 02:50:45 +00:00

ops: schedule session reaping — tower-sessions DeletionTask is never spawned, so sessions grow unbounded

#159 by rosa was closed 2026-08-10 01:41:28 +00:00

ops: make OTLP telemetry export opt-in so a small-box deploy needs no collector

1

#155 by rosa was closed 2026-08-11 01:42:37 +00:00

ops: document a consistent backup procedure; cp of a live WAL database is unsafe

1

#153 by rosa was closed 2026-08-10 02:50:35 +00:00

web: Confirmation tokens in /confirm/{token} URLs are recorded in TraceLayer spans

1

#95 by rosa was closed 2026-07-04 19:05:52 +00:00

web: Atom feed omits the required id and updated elements

1

#94 by rosa was closed 2026-07-05 00:49:46 +00:00

web: Rate limiters key on the TCP peer, ignoring RealIpLayer's resolved client IP

2

#91 by rosa was closed 2026-07-05 18:09:10 +00:00

domain: in-memory mock repo diverges from Postgres (reset-token action_type; missing EmailTaken)

1

#63 by rosa was closed 2026-07-04 18:40:29 +00:00

domain: revoke_access_token returns Ok for a foreign/nonexistent token while the UI reports success

1

#62 by rosa was closed 2026-07-03 21:33:35 +00:00

domain: redeem_authorization_code deletes the code before loading the user, burning it on transient errors

1

#61 by rosa was closed 2026-07-03 21:39:14 +00:00

domain: password-reset job retries mint additional valid reset tokens

1

#59 by rosa was closed 2026-07-03 21:34:21 +00:00

domain: login lockout uses a stale whole-row read-modify-write, racing the counter and clobbering profile edits

1

#56 by rosa was closed 2026-07-04 04:03:21 +00:00

domain: expired/invalid password-reset token surfaces as 500 Unknown instead of link-expired

1

#54 by rosa was closed 2026-07-03 21:41:40 +00:00

domain: publishing a draft via Micropub update leaves published_at unset, post never goes live

2

#53 by rosa was closed 2026-07-04 16:22:38 +00:00

domain: Micropub category add bypasses the 25-tag cap and bricks the post

2

#51 by rosa was closed 2026-07-03 17:16:42 +00:00

domain: Micropub q=source has no scope check, create-only token can read private/draft posts

1

#50 by rosa was closed 2026-07-03 05:25:15 +00:00

domain: authorization code redemption is non-atomic, concurrent redeems bypass single-use

1

#49 by rosa was closed 2026-07-03 21:39:14 +00:00