All issues

Search results

image-service: list_images unwrapped except returns str(e) 500 (same leak class #246 fixed duckdb-side)

hardening

Status: Open.

#284 In schutera/highfive;

· cofade opened on Sep 25, 2026

hygiene: operator email is write-only residue (firmware sends, duckdb stores, nobody reads) — stop collecting or add an admin-gated read

hardening

Status: Open.

#283 In schutera/highfive;

· cofade opened on Sep 25, 2026

ADR-008 follow-up: OTA updates are unsigned (MD5-only) and shared by the whole fleet; no per-device identity

firmwareESP32-CAM firmware changeESP32-CAM firmware change

securitySecurity-related issue or fixSecurity-related issue or fix

Status: Open.

#281 In schutera/highfive;

· cofade opened on Sep 5, 2026

setup wizard cannot flash on production: /firmware.bin, /firmware.app.bin and /firmware.json are all missing from the live host

Status: Open.

#275 In schutera/highfive;

· cofade opened on Aug 31, 2026

audit 2026-08-18: tracking epic — 35 findings-driven issues across 4 milestones

chore

Status: Open.

#262 In schutera/highfive;

· cofade opened on Aug 18, 2026

geolocation: the Google API key is a plaintext literal in the publicly served firmware.bin/firmware.app.bin — document it as public-by-construction and enforce quota/API restrictions

documentationImprovements or additions to documentationImprovements or additions to documentation

securitySecurity-related issue or fixSecurity-related issue or fix

Status: Open.

#261 In schutera/highfive;

· cofade opened on Aug 18, 2026

onboarding: .env.example is a production template that README's dev quick start copies into the dev compose stack; three docs describe three different dev .env files

documentationImprovements or additions to documentationImprovements or additions to documentation

good first issueGood for newcomersGood for newcomers

Status: Open.

#260 In schutera/highfive;

· cofade opened on Aug 18, 2026

firmware structure (long-running): 61% of firmware LOC is compile-checked only — extract the boot sequence into host-testable libs; plan the core-3.x/ArduinoJson-7 migration

enhancementNew feature or requestNew feature or request

firmwareESP32-CAM firmware changeESP32-CAM firmware change

Status: Open.

#259 In schutera/highfive;

· cofade opened on Aug 18, 2026

duckdb-service: ADR-013 compensating-restore rename loses nest/progress rows if the process dies mid-dance; the ADR's "replay would recover" claim is untrue

hardening

Status: Open.

#258 In schutera/highfive;

· cofade opened on Aug 18, 2026

repo hygiene: root .dockerignore, e2e requests pin drift, archive scripts/qr_* experiments, RecursionError in sidecar parse, delete_image URL encoding

chore

dx

Status: Open.

#257 In schutera/highfive;

· cofade opened on Aug 18, 2026

coverage fill: ApiService round-trip tests, POST /api/admin/weather/backfill proxy, /api/images happy paths, Playwright admin delete spec, APScheduler leak in duckdb tests

test

Status: Open.

#256 In schutera/highfive;

· cofade opened on Aug 18, 2026

backend polish: proxy error semantics table, malformed upstream timestamp 500s the fleet listing, unbounded login-attempt Map, image proxy buffering/no cache headers, comment rot

dx

enhancementNew feature or requestNew feature or request

Status: Open.

#255 In schutera/highfive;

· cofade opened on Aug 18, 2026