BUG: Upload routes missing authentication —
requireAuth imported but never used
BUG: Cluster screen "Remove node" sends DELETE to wrong URL —
/cluster/nodes/:id vs server /:id
BUG:
recorders.js dockerApi has no socket timeout — hung Docker socket blocks recorder start/stop indefinitely
BUG:
proxy.js worker sets status='error' on failure at end — overrides existing live/ingesting status
Filmstrip generation timeout on long videos
BUG:
GET /assets with both status and include_archived=true — archived filter overrides status filter
BUG: Trim jobs invisible in Jobs screen — inserted into DB
jobs table but screen reads BullMQ only
SECURITY: SDK archive upload vulnerable to path traversal (tar/zip slip) — attacker can write arbitrary files on the server
BUG:
upload.js imports from non-existent ../middleware/requireAuth.js — server crashes on startup if rebuilt
BUG: Thumbnail failure silently overrides proxy failure — flips asset to
ready even when proxy is absent
BUG: Upload routes missing authentication —
requireAuth imported but never used
BUG: Multipart upload failure leaves dangling S3 parts and 'ingesting' asset row — no cleanup on error
BUG: Containers tab always shows
RUNNING badge and hardcoded 0% CPU / 0 MB memory
BUG: Cluster screen "Remove node" sends DELETE to wrong URL —
/cluster/nodes/:id vs server /:id
BUG:
shell.jsx Jobs nav badge hardcoded to "3" — always shows "3" regardless of actual job count
Filmstrip generation timeout on long videos
[Low] normalizeAsset seed uses only first char of ID (6 variations)
[Low] No error state when loadData fails - empty UI with no warning