All issues

🚨 issue (security): No validation for project existence or user authorization.

#403

· crimsonstrife opened

on Oct 2, 2025

This creates N+1 database queries where N is the number of issues on the page. Each call to allowedToStatusesForIssue() will execute separate queries. Consider batch loading the transitions data or moving this logic to a more efficient approach.

#398

· crimsonstrife opened

on Oct 1, 2025

The hardcoded 'zzzz' and empty string values for null handling in ORDER BY clauses are magic values that make the code unclear. Consider defining these as named constants or using a more explicit approach for null value sorting.

#397

· crimsonstrife opened

on Oct 1, 2025

The sort column is not validated before being passed to `orderBy()`, which could allow SQL injection or cause errors if invalid column names are provided. Add validation to ensure only whitelisted columns can be sorted on.

#386

· crimsonstrife opened

on Sep 29, 2025

The `withCount` aggregates on lines 39-43 are immediately overridden by the `selectSub` queries on lines 61-95. This creates unnecessary database queries and potential confusion. Remove the `withCount` and `withSum` calls since the manual subqueries are used instead.

#385

· crimsonstrife opened

on Sep 29, 2025

Extract the hard-coded permission strings into config or constants to make permission management more maintainable

#378

· crimsonstrife opened

on Sep 29, 2025