Issues

• [Frontend] sitemap.xml lists wallet-gated app routes as publicly crawlable pages

  enhancementfrontendthird-wave-audit
  LabsCrypt/flowfi#1549 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [DevOps] render.yaml still declares SOROBAN_SECRET_KEY and ADMIN_SECRET, both dead in current code

  devopsinfrathird-wave-audit
  LabsCrypt/flowfi#1548 · Filter by author K1NGD4VID opened on Sep 27, 2026
  1

• [Docs] ARCHITECTURE.md's Action Signing Model omits Cancel, wrongly implies only Top-up is custodial

  backenddocssecuritythird-wave-audit
  LabsCrypt/flowfi#1547 · Filter by author K1NGD4VID opened on Sep 27, 2026
  2

• [DevOps] deploy.sh's custom deploy/init error messages are dead code under set -e

  devopsinfrathird-wave-audit
  LabsCrypt/flowfi#1546 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [DevOps] docs/DEVELOPMENT.md tells contributors to docker compose up -d redis but no redis service exists

  dockerdocsinfrathird-wave-audit
  LabsCrypt/flowfi#1545 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Contracts] Test cancel_stream/withdraw when sender equals recipient

  contractssmart-contractsorobantestingthird-wave-audit
  LabsCrypt/flowfi#1544 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Contracts] Test cancel_stream on a fully accrued but never-withdrawn stream

  contractssmart-contractsorobantestingthird-wave-audit
  LabsCrypt/flowfi#1543 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Contracts] Test create_stream InvalidRate rejection fully reverts fee+transfer

  contractssmart-contractsorobantestingthird-wave-audit
  LabsCrypt/flowfi#1542 · Filter by author K1NGD4VID opened on Sep 27, 2026
  1

• [Contracts] Test get_stream/get_fee_config/is_stream_completed on missing state

  contractssmart-contractsorobantestingthird-wave-audit
  LabsCrypt/flowfi#1541 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Frontend] Wire the api-types codegen drift check into CI instead of leaving it manual-only

  cifrontendthird-wave-audit
  LabsCrypt/flowfi#1540 · Filter by author K1NGD4VID opened on Sep 27, 2026
  1

• [Frontend] Add unit tests for the shared Button, Card, and Stepper UI primitives

  frontendtestingthird-wave-audit
  LabsCrypt/flowfi#1539 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Frontend] Remove fabricated 'audited by OpenZeppelin and ConsenSys Diligence' claim in FAQ

  bugfrontendthird-wave-audit
  LabsCrypt/flowfi#1538 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Frontend] Guard JSON.parse of event.metadata in ActivityHistory renderEventMessage

  bugfrontendthird-wave-audit
  LabsCrypt/flowfi#1537 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Backend] Top-up OpenAPI response schema names a field the handler never returns

  apibackenddocsthird-wave-audit
  LabsCrypt/flowfi#1536 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Backend] Sandbox mode sets request flags but nothing ever reads them — isolation is a no-op

  apibackendbugthird-wave-audit
  LabsCrypt/flowfi#1535 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Backend] SSE controller still generates clientId with Math.random(), not crypto.randomUUID

  backendbugrefactorthird-wave-audit
  LabsCrypt/flowfi#1534 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Backend] GET /v1/users/:publicKey/events has no auth, letting anyone enumerate a wallet's history

  backendbugsecuritythird-wave-audit
  LabsCrypt/flowfi#1533 · Filter by author K1NGD4VID opened on Sep 27, 2026

• [Backend] createStreamSchema Zod validator is still unused; depositedAmount has no MAX_I128 cap

  backendbugsecuritythird-wave-auditvalidation
  LabsCrypt/flowfi#1532 · Filter by author K1NGD4VID opened on Sep 27, 2026

• Stellar Testnet E2E suite failing

  Stellar Wavetestnet-e2e-failure
  LabsCrypt/flowfi#1523 · Filter by author github-actions opened on Sep 27, 2026
  22

  

• [Docs] Create visual architecture diagram and sequence flow for Batch Withdrawal in docs/

  docsdrips-waveStellar Wavevisual
  LabsCrypt/flowfi#1522 · Filter by author blurbeast opened on Sep 27, 2026
  6

  

• [DevOps] Add Dependabot grouping rule for Rust dependencies in Cargo.toml

  cidevopsdrips-waveStellar Wave
  LabsCrypt/flowfi#1521 · Filter by author blurbeast opened on Sep 27, 2026
  8

  

• [SDK] Implement exponential backoff retry helper for Soroban RPC transaction status polling

  drips-wavereliabilitysdkStellar Wave
  LabsCrypt/flowfi#1520 · Filter by author blurbeast opened on Sep 27, 2026
  7

  

• [Contracts] Add storage bump helper for recipient position lookups to prevent TTL expiration

  drips-wavesmart-contractsStellar Wavestorage
  LabsCrypt/flowfi#1519 · Filter by author blurbeast opened on Sep 27, 2026
  3

  

• [Contracts] Add unit tests verifying behavior when stream end_time equals start_time

  drips-wavesmart-contractsStellar Wavetesting
  LabsCrypt/flowfi#1518 · Filter by author blurbeast opened on Sep 27, 2026
  2

  

• [Contracts] Emit dedicated ProtocolPaused and ProtocolUnpaused events on pause toggle

  drips-waveeventssmart-contractsStellar Wave
  LabsCrypt/flowfi#1517 · Filter by author blurbeast opened on Sep 27, 2026
  4