Search results

[QA] Non-existent pages return HTTP 200 instead of 404 (SPA catch-all)

Status: Open.

#38 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Mobile viewport — 14 interactive elements have tap targets below 44px (WCAG 2.5.5)

Status: Open.

#37 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Login link in navigation redirects back to homepage instead of /login

Status: Open.

#36 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Login form — no validation shown when submitting empty form

Status: Open.

#35 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Signup flow broken — CTA buttons lead to /install, no web registration form

Status: Open.

#34 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] JavaScript console error on landing page — script resource behind redirect

Status: Open.

#33 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[QA] Broken images on landing page — logo.svg fails to load

Status: Open.

#32 In profullstack/smshub;

· jarvisstark011010-cpu opened on Mar 20, 2026

[Security] Providers API also uses serviceClient, bypasses Supabase RLS

Status: Open.

#30 In profullstack/smshub;

· hhhashexe opened on Mar 19, 2026

[Security] Telnyx webhook signature validation also conditionally disabled

Status: Open.

#29 In profullstack/smshub;

· hhhashexe opened on Mar 19, 2026

[Security] Provider API credentials (api_key, api_secret) returned in plaintext via GET /api/providers

Status: Open.

#28 In profullstack/smshub;

· hhhashexe opened on Mar 19, 2026

[Security] CSV injection via contact names — formula injection in export

Status: Open.

#27 In profullstack/smshub;

· hhhashexe opened on Mar 19, 2026

[Info] CSP header allows unsafe-inline and unsafe-eval for scripts

Status: Open.

#26 In profullstack/smshub;

· hhhashexe opened on Mar 19, 2026