J3vbandClaude 463f1d546f Fix 27 findings from 2026-08-21 bug hunt (#1400) ...

* chore(findings): record 2026-08-21 bug hunt (38 findings)

* fix(api): 1 defect(s) (OC-0240)

* fix(client): 1 defect(s) (OC-0241)

* fix(plugin): 2 defect(s) (OC-0243, OC-0265)

* fix(client): 3 defect(s) (OC-0244, OC-0256, OC-0259)

* fix(client): 1 defect(s) (OC-0247)

* fix(client): 2 defect(s) (OC-0248, OC-0258)

* fix(identity): 1 defect(s) (OC-0250)

* fix(ws): 3 defect(s) (OC-0252, OC-0269, OC-0272)

* fix(admin): 1 defect(s) (OC-0253)

* fix(client): 1 defect(s) (OC-0254)

* fix(voice): 1 defect(s) (OC-0255)

* fix(ws): 1 defect(s) (OC-0260)

* fix(client): 1 defect(s) (OC-0261)

* fix(client): 1 defect(s) (OC-0262)

* fix(client): 1 defect(s) (OC-0263)

* fix(client): 1 defect(s) (OC-0264)

* fix(client): 1 defect(s) (OC-0268)

* fix(ws): 1 defect(s) (OC-0273)

* fix(service): 1 defect(s) (OC-0275)

* style: satisfy golangci-lint and prettier on 2026-08-21 fix commits

- drop ineffectual backupDir reset before return (registry.go, OC-0265)
- reflow long boolean expression (attachments.ts, OC-0241)

* fix(client): 4 defect(s) (OC-0242, OC-0246, OC-0249, OC-0251)

* fix(voice): 1 defect(s) (OC-0267)

* fix(admin): 1 defect(s) (OC-0274)

* fix(voice): 1 defect(s) (OC-0245)

* fix(ws): 1 defect(s) (OC-0271)

* fix(voice): 2 defect(s) (OC-0239, OC-0257)

* fix(ws): 1 defect(s) (OC-0266)

* fix(voice): 1 defect(s) (OC-0270)

* style: clear golangci-lint modernize and prettier nits from 2026-08-21 fixes

- range-over-int and slices.Contains modernizations in new Go test files
- prettier reflow in dispatcher.ts

* chore(findings): mark 2026-08-21 hunt findings fixed/declined

37 fixed across the fix waves, OC-0238 declined (LiveKit webhook TLS
requires a product decision, not a mechanical patch).

---------

Co-authored-by: Claude <noreply@anthropic.com>

2026-08-21 12:41:56 +02:00

..

testdata/fuzz

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

auth_handler_delete_broadcast_test.go

fix: resolve 107 verified defects across ws hub, voice/E2EE, db, and client (#1331)

2026-08-07 21:20:48 +02:00

auth_handler_test.go

fix: 40 correctness fixes from the 2026-08-19 bug hunt (#1392)

2026-08-19 16:32:07 +02:00

auth_handler.go

fix: 40 correctness fixes from the 2026-08-19 bug hunt (#1392)

2026-08-19 16:32:07 +02:00

avatar_handler_test.go

infra: observability, backups, guardrails, and deployment hardening (#1376)

2026-08-15 20:50:47 +02:00

blocks_handler_test.go

test: close measured test-coverage gaps across server, client and Rust

2026-07-25 14:47:21 +00:00

bodycap_test.go

fix: resolve 107 verified defects across ws hub, voice/E2EE, db, and client (#1331)

2026-08-07 21:20:48 +02:00

channel_around_test.go

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

channel_authz_test.go

refactor(server): thread context.Context through the db layer and all callers

2026-07-23 17:03:52 +02:00

channel_handler_test.go

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

channel_handler.go

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

channel_reaction_users_test.go

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

client_update_test.go

fix(updater): make client auto-update work end-to-end and Linux server self-update verifiable

2026-07-23 18:38:22 +02:00

client_update.go

fix(updater): make client auto-update work end-to-end and Linux server self-update verifiable

2026-07-23 18:38:22 +02:00

clientip_test.go

Fix 27 findings from 2026-08-21 bug hunt (#1400)

2026-08-21 12:41:56 +02:00

constants_test.go

test: audit 2026-08-19 — fix stale tests, close coverage gaps (#1397)

2026-08-20 19:29:31 +02:00

constants.go

infra: observability, backups, guardrails, and deployment hardening (#1376)

2026-08-15 20:50:47 +02:00

contract_test.go

refactor(server): thread context.Context through the db layer and all callers

2026-07-23 17:03:52 +02:00

coverage_push_test.go

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

crs_fs_test.go

release: v1.1.0-alpha.4 — first-run setup wizard, LiveKit auto-download, WAF & CI fixes (#1292)

2026-07-31 15:41:57 +02:00

crs_fs.go

release: v1.1.0-alpha.4 — first-run setup wizard, LiveKit auto-download, WAF & CI fixes (#1292)

2026-07-31 15:41:57 +02:00

diagnostics_handler_test.go

refactor(server): thread context.Context through the db layer and all callers

2026-07-23 17:03:52 +02:00

diagnostics_handler.go

fix: resolve 20 code review bugs across Rust, TypeScript, and Go

2026-04-03 23:18:06 +02:00

dm_group_handler_test.go

fix: batch of 34 correctness fixes across server and client (#1372)

2026-08-14 18:48:10 +02:00

dm_handler_block_context_test.go

fix: correctness fixes from the 2026-08-20 bug hunt (#1398)

2026-08-20 20:45:30 +02:00

dm_handler_create_notify_test.go

fix: correctness fixes from the 2026-08-20 bug hunt (#1398)

2026-08-20 20:45:30 +02:00

dm_handler_rename_participant_lookup_test.go

fix: batch of correctness fixes across server and client (#1375)

2026-08-15 16:30:05 +02:00

dm_handler_test.go

fix: correctness fixes from the 2026-08-20 bug hunt (#1398)

2026-08-20 20:45:30 +02:00

dm_handler_visibility_ctx_test.go

fix: batch of 29 correctness fixes across server and client (#1369)

2026-08-14 10:05:40 +02:00

dm_handler_watermark_voice_test.go

fix: execute the 2026-08-19 audit fix order (docs refresh + five FRAGILE fixes) (#1396)

2026-08-20 03:49:13 +02:00

dm_handler.go

fix: correctness fixes from the 2026-08-20 bug hunt (#1398)

2026-08-20 20:45:30 +02:00

emoji_handler_test.go

fix: batch of 29 correctness fixes across server and client (#1369)

2026-08-14 10:05:40 +02:00

emoji_handler.go

refactor(server): work off the complexity backlog — 62 findings to 0 (#1389)

2026-08-18 20:39:45 +02:00

export_test.go

fix: batch of 29 correctness fixes across server and client (#1369)

2026-08-14 10:05:40 +02:00

filestore.go

infra: observability, backups, guardrails, and deployment hardening (#1376)

2026-08-15 20:50:47 +02:00

gif_handler_internal_test.go

fix: batch of 25 correctness fixes across server and client (#1370)

2026-08-14 14:49:27 +02:00

gif_handler_test.go

feat(api): proxy Klipy GIF requests server-side so no key ships to clients

2026-07-20 13:29:46 +02:00

gif_handler.go

fix: batch of 25 correctness fixes across server and client (#1370)

2026-08-14 14:49:27 +02:00

health_test.go

infra: observability, backups, guardrails, and deployment hardening (#1376)

2026-08-15 20:50:47 +02:00

image_dimensions_fuzz_test.go

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

invite_handler_test.go

refactor(server): thread context.Context through the db layer and all callers

2026-07-23 17:03:52 +02:00

invite_handler.go

feat(server): logging & error-visibility hardening

2026-07-24 11:07:12 +02:00

livekit_proxy_test.go

release: v1.1.0-alpha.5 — voice origin fixes (desktop + same-origin), log-stream API tokens (#1296)

2026-07-31 18:30:31 +02:00

livekit_proxy_ws_test.go

fix: resolve golangci-lint failures and correct audit-doc inaccuracies

2026-07-28 12:25:10 +00:00

livekit_proxy.go

release: v1.1.0-alpha.5 — voice origin fixes (desktop + same-origin), log-stream API tokens (#1296)

2026-07-31 18:30:31 +02:00

livekit_ratelimit_test.go

fix: resolve 107 verified defects across ws hub, voice/E2EE, db, and client (#1331)

2026-08-07 21:20:48 +02:00

logbounds_test.go

fix(api): bound the logged request id and path (F8)

2026-07-30 15:13:48 +02:00

main_test.go

release: v1.1.0-alpha.4 — first-run setup wizard, LiveKit auto-download, WAF & CI fixes (#1292)

2026-07-31 15:41:57 +02:00

metrics_handler_test.go

infra: observability, backups, guardrails, and deployment hardening (#1376)

2026-08-15 20:50:47 +02:00

metrics_handler.go

infra: observability, backups, guardrails, and deployment hardening (#1376)

2026-08-15 20:50:47 +02:00

middleware_test.go

fix: correctness fixes from the 2026-08-20 bug hunt (#1398)

2026-08-20 20:45:30 +02:00

middleware.go

Fix 27 findings from 2026-08-21 bug hunt (#1400)

2026-08-21 12:41:56 +02:00

plugins_handler_test.go

release: v1.1.0-alpha.4 — first-run setup wizard, LiveKit auto-download, WAF & CI fixes (#1292)

2026-07-31 15:41:57 +02:00

plugins_handler.go

release: v1.1.0-alpha.4 — first-run setup wizard, LiveKit auto-download, WAF & CI fixes (#1292)

2026-07-31 15:41:57 +02:00

profile_handler_fuzz_test.go

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

profile_handler_identity_key_test.go

fix: resolve 107 verified defects across ws hub, voice/E2EE, db, and client (#1331)

2026-08-07 21:20:48 +02:00

profile_handler_test.go

fix: correctness fixes from the 2026-08-20 bug hunt (#1398)

2026-08-20 20:45:30 +02:00

profile_handler.go

fix: correctness fixes from the 2026-08-20 bug hunt (#1398)

2026-08-20 20:45:30 +02:00

router_delete_account_broadcast_test.go

fix: batch of 25 correctness fixes across server and client (#1370)

2026-08-14 14:49:27 +02:00

router_livekit_process_test.go

fix: correctness fixes across LiveKit voice, client session and transport paths (#1374)

2026-08-15 12:57:51 +02:00

router_test.go

fix(phase-bc): address review findings — auth, SSRF, seq alignment

2026-04-06 09:29:29 +00:00

router_totp_key_fatal_test.go

fix: batch of correctness fixes across server and client (#1375)

2026-08-15 16:30:05 +02:00

router.go

refactor(server): work off the complexity backlog — 62 findings to 0 (#1389)

2026-08-18 20:39:45 +02:00

totp_handler_test.go

fix: 11 defects from bughunt sweep across server, db and client (#1382)

2026-08-16 17:06:11 +02:00

totp_handler.go

refactor(server): work off the complexity backlog — 62 findings to 0 (#1389)

2026-08-18 20:39:45 +02:00

upload_filename_fuzz_test.go

Release v1.2.0-alpha.1 -> main (#1309)

2026-08-01 22:06:14 +02:00

upload_handler_deleted_message_test.go

fix: resolve 107 verified defects across ws hub, voice/E2EE, db, and client (#1331)

2026-08-07 21:20:48 +02:00

upload_handler_test.go

fix: correctness fixes from the 2026-08-20 bug hunt (#1398)

2026-08-20 20:45:30 +02:00

upload_handler.go

refactor(server): work off the complexity backlog — 62 findings to 0 (#1389)

2026-08-18 20:39:45 +02:00

waf_crs_test.go

release: v1.1.0-alpha.4 — first-run setup wizard, LiveKit auto-download, WAF & CI fixes (#1292)

2026-07-31 15:41:57 +02:00

waf_test.go

test: audit 2026-08-19 — fix stale tests, close coverage gaps (#1397)

2026-08-20 19:29:31 +02:00

waf.go

refactor(server): work off the complexity backlog — 62 findings to 0 (#1389)

2026-08-18 20:39:45 +02:00