Issues

• [BUG] Challenge endpoint doesn't rate-limit per-wallet, allowing unlimited challenge generation

  backendbugdifficulty: easypriority: mediumsecurity
  trustflow-protocol/trustflow-backend#993 · Filter by author meshackyaro opened on Oct 30, 2026
  5

• [BUG] Multi-provider pin fan-out doesn't verify all providers actually have the content before reporting success

  bugdifficulty: mediuminfrastructurepriority: mediumreliability
  trustflow-protocol/trustflow-backend#992 · Filter by author meshackyaro opened on Oct 30, 2026
  2

• [BUG] Reconciliation alert messages don't include a direct link to the affected escrow, slowing manual triage

  bugdifficulty: easygood first issuepriority: lowreliabilityweb3
  trustflow-protocol/trustflow-backend#991 · Filter by author meshackyaro opened on Oct 30, 2026
  3

• [BUG] Grafana dashboard JSON committed to the repo has drifted from what's actually deployed, misleading anyone trying to reproduce it

  bugdevopsdifficulty: easydocumentationinfrastructurepriority: low
  trustflow-protocol/trustflow-backend#990 · Filter by author meshackyaro opened on Oct 30, 2026
  4

• [BUG] Reputation API doesn't expose a breakdown of how a score was composed, making disputes about a wallet's score impossible to investigate

  backendbugcoredifficulty: mediumpriority: medium
  trustflow-protocol/trustflow-backend#989 · Filter by author meshackyaro opened on Oct 30, 2026
  2

• [BUG] Outbox cleanup job's retention window is configured in days but the comparison uses the row's creation time instead of its delivered time

  bugdifficulty: easygood first issueinfrastructurepriority: lowreliability
  trustflow-protocol/trustflow-backend#988 · Filter by author meshackyaro opened on Oct 30, 2026
  2

• [BUG] Event-ingestion health metric reports healthy based on process liveness alone, not actual ingestion progress

  bugdifficulty: easygood first issueinfrastructurepriority: mediumweb3
  trustflow-protocol/trustflow-backend#987 · Filter by author meshackyaro opened on Oct 30, 2026
  2

• [BUG] Soroban contract invocation retries on "account not found" the same as a true transient error, masking a real configuration problem

  bugcontractdifficulty: easypriority: lowweb3
  trustflow-protocol/trustflow-backend#986 · Filter by author meshackyaro opened on Oct 30, 2026
  7

• [BUG] Dispute status webhook fires before the database transaction committing the status change has actually committed

  backendbugcoredifficulty: mediumpriority: medium
  trustflow-protocol/trustflow-backend#985 · Filter by author meshackyaro opened on Oct 30, 2026

• [BUG] Webhook secret rotation has no grace period, instantly invalidating in-flight deliveries signed with the old secret

  backendbugdifficulty: mediumpriority: mediumreliability
  trustflow-protocol/trustflow-backend#984 · Filter by author meshackyaro opened on Oct 30, 2026
  2

• [BUG] Webhook delivery payload doesn't include an event-type-specific schema version, making payload evolution risky for subscribers

  backendbugdifficulty: mediumdocumentationpriority: lowreliability
  trustflow-protocol/trustflow-backend#983 · Filter by author meshackyaro opened on Oct 30, 2026
  3

• [BUG] Profile completeness percentage calculation double-counts the bio field under two different weight keys

  backendbugcoredifficulty: easygood first issuepriority: low
  trustflow-protocol/trustflow-backend#982 · Filter by author meshackyaro opened on Oct 30, 2026
  3

• [BUG] Profile avatar upload doesn't validate the file is actually an image before accepting it

  backendbugcoredifficulty: easypriority: highsecurity
  trustflow-protocol/trustflow-backend#981 · Filter by author meshackyaro opened on Oct 30, 2026
  4

• [BUG] Stellar SDK client doesn't pin a specific Horizon/RPC protocol version, risking silent breakage on provider-side upgrades

  bugdifficulty: mediumdocumentationpriority: lowweb3
  trustflow-protocol/trustflow-backend#980 · Filter by author meshackyaro opened on Oct 30, 2026
  1

• [BUG] Indexer's contract-ID filter is case-sensitive, silently missing events if a contract ID is stored with different casing anywhere upstream

  bugdifficulty: mediuminfrastructurepriority: mediumweb3
  trustflow-protocol/trustflow-backend#979 · Filter by author meshackyaro opened on Oct 30, 2026
  8

• [BUG] Sentry release tagging isn't wired up, so every error appears under a generic "unknown release" in the dashboard

  bugdevopsdifficulty: easygood first issuepriority: medium
  trustflow-protocol/trustflow-backend#978 · Filter by author meshackyaro opened on Oct 30, 2026
  3

• [BUG] Reputation event weighting doesn't distinguish a gig's budget size, so a tiny gig and a large gig contribute equally to score

  backendbugcoredifficulty: mediumpriority: low
  trustflow-protocol/trustflow-backend#977 · Filter by author meshackyaro opened on Oct 30, 2026
  1

• [BUG] Outbox consumer registration doesn't handle a consumer crashing mid-batch, leaving messages claimed but never acked

  bugdifficulty: mediuminfrastructurepriority: highreliability
  trustflow-protocol/trustflow-backend#976 · Filter by author meshackyaro opened on Oct 30, 2026

• [BUG] Email notification channel doesn't retry on a transient SMTP timeout, treating it as permanent failure

  backendbugdifficulty: mediumpriority: mediumreliability
  trustflow-protocol/trustflow-backend#975 · Filter by author meshackyaro opened on Oct 30, 2026
  1

• [BUG] Synthetic uptime check only hits the root path, missing outages in authenticated or Soroban-dependent routes

  bugdevopsdifficulty: easygood first issueinfrastructurepriority: medium
  trustflow-protocol/trustflow-backend#974 · Filter by author meshackyaro opened on Oct 30, 2026
  7

• [BUG] Milestone overdue notification repeats every sweep cycle with no cap, rather than sending once and then escalating

  backendbugdifficulty: easygood first issueinfrastructurepriority: medium
  trustflow-protocol/trustflow-backend#973 · Filter by author meshackyaro opened on Oct 30, 2026
  1

• [BUG] Milestone-approaching reminder notification fires based on calendar days, ignoring the escrow's configured timezone-less deadline precision

  backendbugdifficulty: easygood first issueinfrastructurepriority: low
  trustflow-protocol/trustflow-backend#972 · Filter by author meshackyaro opened on Oct 30, 2026
  1

• [BUG] Migration CLI doesn't warn before running a migration that includes a destructive DROP COLUMN

  bugdatabasedevopsdifficulty: mediumpriority: mediumsecurity
  trustflow-protocol/trustflow-backend#971 · Filter by author meshackyaro opened on Oct 30, 2026

• [BUG] Pinning provider health check doesn't actually exercise the pin API, only a generic ping endpoint

  bugdifficulty: mediuminfrastructurepriority: mediumreliability
  trustflow-protocol/trustflow-backend#970 · Filter by author meshackyaro opened on Oct 30, 2026

• [BUG] Gig applicant list endpoint doesn't let the gig owner filter out withdrawn applications

  backendbugcoredifficulty: easygood first issuepriority: low
  trustflow-protocol/trustflow-backend#969 · Filter by author meshackyaro opened on Oct 30, 2026
  1