node-agent BMD_COUNT override hardcodes /dev/blackmagic/dv${i} but real devices are /dev/blackmagic/io${i}
zampp2 GPU capabilities stuck on raw /dev detection — GPU_COUNT env override blocks nvidia-smi enrichment
Node hijack: POST /cluster/heartbeat allows any authed user to overwrite primary node's api_url
Migrations silently swallow failures — partial schema upgrades leave server running on broken DB
Secret leak: recorder start error response includes full Docker create payload (S3 keys, stream keys)
SSRF: POST /recorders/probe accepts arbitrary URLs and probes raw TCP/UDP on internal network
Scheduler tick has race condition — multi-node deploy will double-fire recorder starts
Error handler leaks raw Postgres error messages (schema/column/UUID syntax) to clients
UUID path params not validated — every /:id route returns 500 with PG error on bad input
No graceful shutdown handler — SIGTERM kills mam-api mid-tick, leaks Redis + Docker sockets
Build & deploy Premiere panel v1.1.0 to BMG-PC-Edit