2026-06-24T02:34:39Z - 2026-09-24T02:34:39Z
Overview
6 pull requests proposed by 1 user
Proposed
#25 fix(guest): make Swish QR scannable on guest payment page (#22)
Proposed
#26 fix(db): add CHECK constraint for userId XOR guestToken invariant (#23)
Proposed
#27 fix(payment): persist amountPaid on payment confirmation (#20)
Proposed
#28 fix(guest): move guest token from URL query to sessionStorage (#21)
Proposed
#29 feat(security): add per-IP rate limiting on guest-order endpoints (#19)
Proposed
#30 fix(security): gate guest self-confirmed orders behind PENDING_REVIEW (#18)
1 issue closed from 1 user
Closed
#24 [Bug] normalizeSwishNumber does not strip leading '+', breaking Swish payment for +46 numbers
6 unresolved conversations
Open
#18
[Security] Honor-system payment confirmation: no Swish money verification on guest /pay endpoint
Open
#19
[Security] No rate limiting / abuse protection on public POST /api/guest-orders
Open
#21
[Security] Guest token rides in URL query string - leaks via access logs / history / Referer
Open
#20
[Bug] amountPaid never persisted on guest or authenticated payment confirmation
Open
#23
[Data integrity] No DB-level CHECK constraint for userId XOR guestToken invariant
Open
#22
[Bug] Swish QR fails to scan on desktop - margin, color, width non-compliant with ISO 18004 / Swish spec