2025-07-15 - 2026-07-15
Overview
2 Issues closed from 1 user
Closed
#2 Move hardcoded Gmail app password out of reminders.py into env
Closed
#31 Extract shared storage helper (DATA_DIR/load/save duplicated 7x)
42 Issues created by 1 user
Opened
#1 Remove hardcoded Flask secret_key fallback ("fullmoonbakehouse")
Opened
#2 Move hardcoded Gmail app password out of reminders.py into env
Opened
#3 Sanitize upload filename — path traversal in import route
Opened
#4 Add MAX_CONTENT_LENGTH + content-type check to the PDF/CSV import route
Opened
#5 Add authentication + CSRF protection to all mutating routes
Opened
#6 Escape input in bold_md filter before wrapping in Markup (stored XSS)
Opened
#7 Make Werkzeug debug mode opt-in instead of debug=True
Opened
#8 Cap pasted statement text size before regex parsing
Opened
#9 Guard the /suggestions HTML page with the same auth as its API
Opened
#10 Add Subresource Integrity (SRI) to CDN-loaded Chart.js
Opened
#11 Make all JSON saves atomic (temp file + os.replace)
Opened
#12 Handle JSONDecodeError in all load_* functions
Opened
#13 Fix concurrent JSON read-modify-write race (2 gunicorn workers, no lock)
Opened
#14 Roll back multi-file saves on partial failure
Opened
#15 Fix biweekly mortgage schedule interest basis (overstates payoff)
Opened
#16 Remove dead code and fix off-by-one in current_balance_estimate
Opened
#17 Clamp bills due on day 29-31 in short months (calendar drops them)
Opened
#18 Initialize next_num before loop in bnpl_payment (UnboundLocalError 500)
Opened
#19 Validate int() parsing of form year/month (raises 500 on bad input)
Opened
#20 Fix simulate_payoff 4th return value double-counting minimums
Opened
#21 Fix amortization float rounding leaving non-zero final balance
Opened
#22 Fix payoff_months divergence guard when monthly_charges>0
Opened
#23 Stop load_funds from returning the mutable DEFAULT_FUNDS list
Opened
#24 Replace 30-day-month BNPL approximation with calendar math
Opened
#25 Align upload save path with the /uploads serving route
Opened
#26 Include bills in client-side updateLeftover() in weekly.html
Opened
#27 Cast income_delete year/month to int for url_for
Opened
#28 Cap split_transaction's unbounded while-loop
Opened
#29 Recompute freed minimums each month in simulate_payoff
Opened
#30 Harden income_ytd year filtering (string prefix match)
Opened
#31 Extract shared storage helper (DATA_DIR/load/save duplicated 7x)
Opened
#32 Define TAX_FILE after DATA_DIR to avoid divergent fallbacks
Opened
#33 Cache per-request transaction reads (badge reloads full JSON every page)
Opened
#34 Pin python-dateutil, requests, gunicorn in requirements.txt
Opened
#35 Run the container as a non-root user
Opened
#36 Pin the base image by digest
Opened
#37 Remove redundant double pip install of gunicorn/requests
Opened
#38 Add a committed .env.example documenting all env vars
Opened
#39 Remove unused FastAPI suggestions adapter from the image
Opened
#40 Strip template scaffolding comments from the Dockerfile
Opened
#41 Replace scattered inline styles with CSS utility classes
Opened
#42 Self-host Google Fonts instead of CDN @import