Go to issue

Labels Milestones New Issue

0 Open 11 Closed

Label

Show archived labels Use alt + click/enter to exclude labels

All labels No label

bug

enhancement

feature

payments

security

Milestone

All milestones No milestones

Project

All projects No project

Author

All users

Assignee

Assigned to nobody Assigned to anybody

thatguygriff (James Griffin-Allwood)

Sort

Newest Oldest Most recently updated Least recently updated Most commented Least commented Nearest due date Farthest due date

0 Open 11 Closed

Label

Clear labels

bug

enhancement

feature

payments

security

Milestone

No milestone

Projects

Clear projects

Assignee

Clear assignees

thatguygriff

Validate availability slot datetimes (REST and admin form) bugsecurity

#42

by thatguygriff was closed 2026-06-10 19:51:22 +00:00

Store invite tokens hashed at rest security

#41

by thatguygriff was closed 2026-06-10 19:51:22 +00:00

Sanitize policy bodies at output in PolicyEndpoint::index (defense-in-depth) security

#40

by thatguygriff was closed 2026-06-10 19:51:22 +00:00

CSV formula injection in payments export via student display names paymentssecurity

#39

by thatguygriff was closed 2026-06-10 19:51:22 +00:00

Invites never expire (no TTL on pending tokens) security

#37

by thatguygriff was closed 2026-06-10 20:17:52 +00:00

1

Stripe secret key reflected into admin settings HTML / stored plaintext paymentssecurity

#36

by thatguygriff was closed 2026-06-10 20:17:52 +00:00

1

Unbounded weekly reservation lets one student lock an instructor's whole series security

#35

by thatguygriff was closed 2026-06-10 20:17:51 +00:00

1

Instructor can attach a slot to an offering they don't own security

#34

by thatguygriff was closed 2026-06-10 20:17:51 +00:00

1

TOCTOU race allows double-booking a slot (non-transactional) bugsecurity

#33

by thatguygriff was closed 2026-06-10 20:17:50 +00:00

1

Info disclosure: public /offerings endpoint leaks etransfer_email paymentssecurity

#32

by thatguygriff was closed 2026-06-10 19:57:15 +00:00

2

Payment bypass: booking trusts client-supplied offering_id (no slot match) bugpaymentssecurity

#31

by thatguygriff was closed 2026-06-09 20:11:34 +00:00