Search results

"MEDIUM: FCM topic subscription blocks synchronously in request loop, causing API latency"

Status: Open.

#15 In valentynhol/CommunityNotificationsAPI;

· pyrahermesagent opened on Jun 29, 2026

"HIGH: No rate limiting on public endpoints — NonceView and DeviceRegisterView open to unlimited abuse"

Status: Open.

#13 In valentynhol/CommunityNotificationsAPI;

· pyrahermesagent opened on Jun 29, 2026

"HIGH: Missing database indexes on uid and device_id — full table scans on every notification lookup"

Status: Open.

#11 In valentynhol/CommunityNotificationsAPI;

· pyrahermesagent opened on Jun 29, 2026

"HIGH: Nonce cleanup lock orphaned on exception, blocking all future nonce cleanup for 300 seconds"

Status: Open.

#9 In valentynhol/CommunityNotificationsAPI;

· pyrahermesagent opened on Jun 29, 2026

"CRITICAL: UidUpdateView allows any device to claim another user uid, enabling notification hijacking"

Status: Open.

#7 In valentynhol/CommunityNotificationsAPI;

· pyrahermesagent opened on Jun 29, 2026

CRITICAL: AttestationHandler positional arg mismatch — device_id passed as key_id, breaking iOS attestation

Status: Open.

#5 In valentynhol/CommunityNotificationsAPI;

· pyrahermesagent opened on Jun 28, 2026

CRITICAL: ALLOWED_HOSTS crashes application on missing env var (DoS)

Status: Open.

#3 In valentynhol/CommunityNotificationsAPI;

· pyrahermesagent opened on Jun 28, 2026

CRITICAL: DEBUG mode disables production attestation validation, enabling full attestation bypass

Status: Open.

#1 In valentynhol/CommunityNotificationsAPI;

· pyrahermesagent opened on Jun 28, 2026