Issues

Accessibility pass on the payment flow — QR has no text alternative, copy buttons do not announce, the memo is not marked as required, and errors are not linked to fields

StellarEdu/StellarEduPay#1832 · opened

on Oct 15, 2026

1

Make the parent payment page work well on low-end phones and poor connections — smaller bundle, SSR of instructions, offline-capable QR, and a PWA shell

StellarEdu/StellarEduPay#1831 · opened

on Oct 15, 2026

Create one shared error-code catalog — the backend emits 129 distinct error codes, the frontend maps 65, and 81 backend codes have no user-facing message

StellarEdu/StellarEduPay#1830 · opened

on Oct 15, 2026

Support file-based secrets (`*_FILE`) and a secrets provider for all sensitive config — today only the signer key can come from a secrets manager

StellarEdu/StellarEduPay#1829 · opened

on Oct 15, 2026

1

Production dependencies carry 28 known vulnerabilities (2 critical) — proxy-addr IP spoofing, Next.js DoS, axios SSRF, nodemailer misdelivery and an outdated Stellar SDK

StellarEdu/StellarEduPay#1828 · opened

on Oct 15, 2026

Software supply-chain hardening — pin GitHub Actions by SHA, publish an SBOM, sign images with cosign and add provenance; deploy only verified images

StellarEdu/StellarEduPay#1827 · opened

on Oct 15, 2026

3

Add GitHub issue forms, a PR template and a triage guide — the tracker has 1,000+ issues, frequent near-duplicates, and closed issues that were never actually fixed

StellarEdu/StellarEduPay#1826 · opened

on Oct 15, 2026

4

Load and soak testing against a staging stack — measure end-to-end payment detection latency, poller and stream behaviour and DB contention at realistic school counts

StellarEdu/StellarEduPay#1825 · opened

on Oct 15, 2026

4

Generate a route manifest from Express and contract-test every frontend API helper against it — catch path drift like /audit-logs, /verify/:receiptId and dropped routes

StellarEdu/StellarEduPay#1824 · opened

on Oct 15, 2026

2

Property-based tests for money, stroop and balance invariants — floating-point and rounding bugs keep coming back in new code paths

StellarEdu/StellarEduPay#1823 · opened

on Oct 15, 2026

2

Add a real integration test layer (MongoDB replica set in memory + mocked Horizon) — model-mocking unit tests let global query, tenancy and schema bugs through

StellarEdu/StellarEduPay#1822 · opened

on Oct 15, 2026

2

Add static type checking (checkJs/JSDoc first, TypeScript later) to money, auth and payment modules — most recent production bugs are type errors a checker would have caught

StellarEdu/StellarEduPay#1821 · opened

on Oct 15, 2026

4

Adopt npm workspaces — the root package.json duplicates backend/frontend dependencies (mongoose, react, testing libraries) at different major versions and runs both test suites

StellarEdu/StellarEduPay#1820 · opened

on Oct 15, 2026

2

Exact *Stroops money fields are only backfilled once by migration 035 — no runtime code writes or reads them, so every payment created afterwards is missing them

StellarEdu/StellarEduPay#1819 · opened

on Oct 15, 2026

4

Parents have no way to raise a payment dispute — dispute routes now require staff authentication and the dispute form only appears in the admin view

StellarEdu/StellarEduPay#1810 · opened

on Oct 15, 2026

3

Signed per-student payment links — stop exposing raw student IDs on public endpoints and give parents a secure entry point for status, receipts and disputes

StellarEdu/StellarEduPay#1809 · opened

on Oct 15, 2026

2

One-click "Pay with wallet" on the parent page — Freighter/xBull/Lobstr integration on top of the existing SEP-7 URI, with automatic verification afterwards

StellarEdu/StellarEduPay#1808 · opened

on Oct 15, 2026

3

Wallet readiness and security check for school accounts — USDC trustline, minimum balance, signer/threshold review and memo-required flag, at onboarding and on a schedule

StellarEdu/StellarEduPay#1807 · opened

on Oct 15, 2026

5

README and badges are out of date — CI badge points to a personal fork, Node badge says ">=20", and the docs still describe features that are broken or missing on main

StellarEdu/StellarEduPay#1802 · opened

on Oct 15, 2026

3

Student quota (maxStudents) can be exceeded — check-then-insert race and a 5-minute-stale school cache

StellarEdu/StellarEduPay#1801 · opened

on Oct 15, 2026

3

Super-admin cross-tenant access is not reliably audited — env super-admin tokens never trigger the audit, the IP comes from a spoofable X-Forwarded-For, and performedBy is always "super_admin"

StellarEdu/StellarEduPay#1800 · opened

on Oct 15, 2026

2

After a wallet rotation the old address is never polled again — payments still in flight to previousStellarAddress are never credited

StellarEdu/StellarEduPay#1799 · opened

on Oct 15, 2026

2

Payments with an unknown or mistyped memo are silently dropped — no unmatched-payment queue, so schools never learn that money arrived

StellarEdu/StellarEduPay#1798 · opened

on Oct 15, 2026

2

Every JSON request body is duplicated into req.rawBody as a string, even though only a few webhook routes need the raw bytes

StellarEdu/StellarEduPay#1797 · opened

on Oct 15, 2026

3

Frontend sends no HSTS, Permissions-Policy or cross-origin isolation headers — the parent payment page can be downgraded or framed by policy-less embeds

StellarEdu/StellarEduPay#1796 · opened

on Oct 15, 2026

2

Navigation Menu

Repository navigation

Issues

Accessibility pass on the payment flow — QR has no text alternative, copy buttons do not announce, the memo is not marked as required, and errors are not linked to fields

Make the parent payment page work well on low-end phones and poor connections — smaller bundle, SSR of instructions, offline-capable QR, and a PWA shell

Create one shared error-code catalog — the backend emits 129 distinct error codes, the frontend maps 65, and 81 backend codes have no user-facing message

Support file-based secrets (`*_FILE`) and a secrets provider for all sensitive config — today only the signer key can come from a secrets manager

Production dependencies carry 28 known vulnerabilities (2 critical) — proxy-addr IP spoofing, Next.js DoS, axios SSRF, nodemailer misdelivery and an outdated Stellar SDK

Software supply-chain hardening — pin GitHub Actions by SHA, publish an SBOM, sign images with cosign and add provenance; deploy only verified images

Add GitHub issue forms, a PR template and a triage guide — the tracker has 1,000+ issues, frequent near-duplicates, and closed issues that were never actually fixed

Load and soak testing against a staging stack — measure end-to-end payment detection latency, poller and stream behaviour and DB contention at realistic school counts

Generate a route manifest from Express and contract-test every frontend API helper against it — catch path drift like /audit-logs, /verify/:receiptId and dropped routes

Property-based tests for money, stroop and balance invariants — floating-point and rounding bugs keep coming back in new code paths

Add a real integration test layer (MongoDB replica set in memory + mocked Horizon) — model-mocking unit tests let global query, tenancy and schema bugs through

Add static type checking (checkJs/JSDoc first, TypeScript later) to money, auth and payment modules — most recent production bugs are type errors a checker would have caught

Adopt npm workspaces — the root package.json duplicates backend/frontend dependencies (mongoose, react, testing libraries) at different major versions and runs both test suites

Exact *Stroops money fields are only backfilled once by migration 035 — no runtime code writes or reads them, so every payment created afterwards is missing them

Parents have no way to raise a payment dispute — dispute routes now require staff authentication and the dispute form only appears in the admin view

Signed per-student payment links — stop exposing raw student IDs on public endpoints and give parents a secure entry point for status, receipts and disputes

One-click "Pay with wallet" on the parent page — Freighter/xBull/Lobstr integration on top of the existing SEP-7 URI, with automatic verification afterwards

Wallet readiness and security check for school accounts — USDC trustline, minimum balance, signer/threshold review and memo-required flag, at onboarding and on a schedule

README and badges are out of date — CI badge points to a personal fork, Node badge says ">=20", and the docs still describe features that are broken or missing on main

Student quota (maxStudents) can be exceeded — check-then-insert race and a 5-minute-stale school cache

Super-admin cross-tenant access is not reliably audited — env super-admin tokens never trigger the audit, the IP comes from a spoofable X-Forwarded-For, and performedBy is always "super_admin"

After a wallet rotation the old address is never polled again — payments still in flight to previousStellarAddress are never credited

Payments with an unknown or mistyped memo are silently dropped — no unmatched-payment queue, so schools never learn that money arrived

Every JSON request body is duplicated into req.rawBody as a string, even though only a few webhook routes need the raw bytes

Frontend sends no HSTS, Permissions-Policy or cross-origin isolation headers — the parent payment page can be downgraded or framed by policy-less embeds