| #580 |
[LOW] String literals repeated without constants
String literals like 'application/json', 'Bearer', error codes are repeated multiple times. Fix: Def...
|
closed |
low |
2025-12-17 16:33 |
- |
|
| #579 |
[LOW] Missing docstrings on some internal helper functions
Some internal helper functions lack docstrings, making code harder to understand. Fix: Add docstring...
|
closed |
low |
2025-12-17 16:33 |
- |
|
| #578 |
[LOW] Model naming inconsistencies between API and engine
Some model/schema names differ between API layer and engine layer (e.g., WorkflowDefinition vs workf...
|
closed |
low |
2025-12-17 16:33 |
- |
|
| #577 |
[LOW] Inconsistent async/sync function declarations in blueprints
Some blueprint endpoints use async def while others use def despite all being async handlers. Quart ...
|
closed |
low |
2025-12-17 16:33 |
- |
|
| #576 |
[LOW] List literals that should be tuples for immutability
Several list literals are used for constant data that never changes (e.g., HTTP methods, field names...
|
closed |
low |
2025-12-17 16:33 |
- |
|
| #575 |
[LOW] Unused parameters in some API endpoint handlers
Some endpoint handlers accept parameters (like request objects) that are never used. Fix: Remove unu...
|
closed |
low |
2025-12-17 16:33 |
- |
|
| #574 |
[LOW] Magic numbers in pagination defaults scattered across files
Magic numbers like 20, 50, 100, 200 for pagination defaults are scattered across multiple files. Fix...
|
closed |
low |
2025-12-17 16:33 |
- |
|
| #573 |
[MEDIUM] cron.py TOCTOU in create_schedule/update_schedule
Race condition in cron.py: SELECT to check if schedule exists, then INSERT/UPDATE. Concurrent reques...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #572 |
[MEDIUM] steps.py unbounded list growth in batch operations
Batch step operations can accumulate large in-memory lists without bounds. For very large workflows ...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #571 |
[MEDIUM] Inconsistent error logging - some use exception() some use error()
Error logging is inconsistent across API endpoints. Some use logger.exception() which includes stack...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #570 |
[MEDIUM] Inconsistent timezone handling in API responses
Some timestamps use timezone-aware datetimes while others use naive datetimes. This can cause issues...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #569 |
[MEDIUM] analytics.py unused time_range query parameter
time_range parameter is parsed but never used in some analytics queries, wasting processing. Fix: Ei...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #568 |
[MEDIUM] Public endpoint lists scattered across files
PUBLIC_PATHS and skip-auth endpoint lists are defined in multiple places (rbac.py, auth.py) leading ...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #567 |
[MEDIUM] Missing workflow_id in permission check logs
Permission check audit logs in api/middleware/rbac.py don't include workflow_id when checking workfl...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #566 |
[MEDIUM] security_headers.py CSP nonce generated but unused
CSP nonce is generated on every request but never actually used in responses. This is wasted computa...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #565 |
[MEDIUM] apps.py N+1 query in list_versions endpoint
N+1 query pattern in list_versions endpoint. Each version fetches related data in separate queries i...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #564 |
[MEDIUM] apps.py TOCTOU in update_app/delete_app/publish_version
Multiple TOCTOU race conditions in apps.py: 1) update_app(): SELECT then UPDATE without locking 2) d...
|
closed |
medium |
2025-12-17 16:32 |
- |
|
| #563 |
[API/Memory] logs.py DataFrame copies on every filter operation
File: api/blueprints/v1/logs.py:392-410. Multiple filtering operations create 5+ DataFrame copies. F...
|
closed |
medium |
2025-12-17 16:30 |
- |
|
| #562 |
[API/Perf] logs.py df.iterrows() performance anti-pattern
File: api/blueprints/v1/logs.py:412. df.iterrows() is notoriously slow - creates a Series for each r...
|
closed |
medium |
2025-12-17 16:30 |
- |
|
| #561 |
[API/Memory] tenant_apps.py unbounded tool list in list_available_tools
File: api/blueprints/v1/tenant_apps.py:1256-1298. No pagination. Tenant with many installed apps wit...
|
closed |
medium |
2025-12-17 16:30 |
- |
|