Search results

[Security] AI suggest-reply endpoint vulnerable to prompt injection via inbound SMS

Status: Open.

#44 In profullstack/smshub;

· eltociear opened on Apr 3, 2026

[Security] Auth middleware marks all /api/* paths as public routes

Status: Open.

#43 In profullstack/smshub;

· eltociear opened on Apr 3, 2026

[Security] Bulk send does not verify phone number ownership (missing user_id filter)

Status: Open.

#42 In profullstack/smshub;

· eltociear opened on Apr 3, 2026

[Security] Bulk send allows 100 SMS per request, effectively bypassing per-user rate limit

Status: Open.

#41 In profullstack/smshub;

· eltociear opened on Apr 3, 2026

[Security] Contacts POST route uses serviceClient, bypasses Supabase RLS

Status: Open.

#40 In profullstack/smshub;

· eltociear opened on Apr 3, 2026

[QA] Non-existent pages return HTTP 200 instead of 404 (SPA catch-all)

Status: Open.

#38 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Mobile viewport — 14 interactive elements have tap targets below 44px (WCAG 2.5.5)

Status: Open.

#37 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Login link in navigation redirects back to homepage instead of /login

Status: Open.

#36 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Login form — no validation shown when submitting empty form

Status: Open.

#35 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Signup flow broken — CTA buttons lead to /install, no web registration form

Status: Open.

#34 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] JavaScript console error on landing page — script resource behind redirect

Status: Open.

#33 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Broken images on landing page — logo.svg fails to load

Status: Open.

#32 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026