SECURITY: SDK archive upload vulnerable to path traversal (tar/zip slip) — attacker can write arbitrary files on the server
BUG: Thumbnail failure silently overrides proxy failure — flips asset to
ready even when proxy is absent
[High] refreshAssets useCallback defeats polling effect, causes timer drift
[Medium] Rename project from Library doesn't refresh sidebar rail
[Medium] Project colors shift after deletion + refresh()
BUG: Multipart upload failure leaves dangling S3 parts and 'ingesting' asset row — no cleanup on error
[Medium] submitBin swallows re-fetch errors (dangling promise)
BUG: Recorder scheduler
enqueueNextOccurrence does not check end_at < start_at for cloned rows
BUG: Containers tab always shows
RUNNING badge and hardcoded 0% CPU / 0 MB memory
[Medium] Droppable highlight applied to ALL bins simultaneously
BUG:
shell.jsx Jobs nav badge hardcoded to "3" — always shows "3" regardless of actual job count
BUG: Upload routes missing authentication —
requireAuth imported but never used
BUG: Cluster screen "Remove node" sends DELETE to wrong URL —
/cluster/nodes/:id vs server /:id
BUG:
recorders.js dockerApi has no socket timeout — hung Docker socket blocks recorder start/stop indefinitely
BUG:
proxy.js worker sets status='error' on failure at end — overrides existing live/ingesting status
Filmstrip generation timeout on long videos
BUG:
GET /assets with both status and include_archived=true — archived filter overrides status filter
BUG: Trim jobs invisible in Jobs screen — inserted into DB
jobs table but screen reads BullMQ only
SECURITY: SDK archive upload vulnerable to path traversal (tar/zip slip) — attacker can write arbitrary files on the server