Issues - unsupervised-scheduler - Unsupervised Code

Unsupervised/unsupervised-scheduler

Labels Milestones New Issue

Staff cannot book a lesson for a child or an unapproved student, and group enrolment vets nothing bug security

by thatguygriff was closed 2026-08-24 22:03:12 +00:00

Validate availability slot datetimes (REST and admin form) bug security

by thatguygriff was closed 2026-06-10 19:51:22 +00:00

Store invite tokens hashed at rest security

by thatguygriff was closed 2026-06-10 19:51:22 +00:00

Sanitize policy bodies at output in PolicyEndpoint::index (defense-in-depth) security

by thatguygriff was closed 2026-06-10 19:51:22 +00:00

CSV formula injection in payments export via student display names payments security

by thatguygriff was closed 2026-06-10 19:51:22 +00:00

Invites never expire (no TTL on pending tokens) security

by thatguygriff was closed 2026-06-10 20:17:52 +00:00

Stripe secret key reflected into admin settings HTML / stored plaintext payments security

by thatguygriff was closed 2026-06-10 20:17:52 +00:00

Unbounded weekly reservation lets one student lock an instructor's whole series security

by thatguygriff was closed 2026-06-10 20:17:51 +00:00

Instructor can attach a slot to an offering they don't own security

by thatguygriff was closed 2026-06-10 20:17:51 +00:00

TOCTOU race allows double-booking a slot (non-transactional) bug security

by thatguygriff was closed 2026-06-10 20:17:50 +00:00

Info disclosure: public /offerings endpoint leaks etransfer_email payments security

by thatguygriff was closed 2026-06-10 19:57:15 +00:00

Payment bypass: booking trusts client-supplied offering_id (no slot match) bug payments security

by thatguygriff was closed 2026-06-09 20:11:34 +00:00