Issues

• The two schedulers duplicate 35 lines of advisory-lock boilerplate verbatim, including the same three defects

  enhancement
  MergeFi/backend#853 · Filter by author chonilius opened on Nov 12, 2026
  1

• CreatePoolDto.createdById is taken from the request body, so a caller can create a maintenance pool owned by someone else

  security
  MergeFi/backend#852 · Filter by author chonilius opened on Nov 12, 2026
  2

• README and .env.example do not explain that ESCROW_DEADLINE_SECONDS drives the on-chain permissionless refund window

  documentation
  MergeFi/backend#851 · Filter by author chonilius opened on Nov 12, 2026
  1

• README does not document the dry-run escrow mode, which is how the application behaves in every environment without deployed contracts

  documentation
  MergeFi/backend#850 · Filter by author chonilius opened on Nov 12, 2026
  1

• Nothing reconciles Escrow rows against on-chain state, though six code comments defer to a reconciliation job that does not exist

  architecture
  MergeFi/backend#849 · Filter by author chonilius opened on Nov 12, 2026
  1

• No integration test covers the full merge-to-payout path, the sequence every other test only exercises in pieces

  testing
  MergeFi/backend#848 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts that toPublicUser strips email and the nested githubAccount, which is the only thing preventing a PII leak

  testing
  MergeFi/backend#847 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts that collectConfigIssues returns empty outside production, which is what makes every other environment bootable

  testing
  MergeFi/backend#846 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts that the GitHub webhook signature check runs before anything is persisted

  testing
  MergeFi/backend#845 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts the withLockedEscrow serialization that prevents double payouts

  testing
  MergeFi/backend#844 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts that an idempotency replay of a failed 4xx returns the cached error rather than re-executing

  testing
  MergeFi/backend#843 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test covers EscrowService.fund's three failure paths, which are the only thing standing between a timeout and a double-lock

  testing
  MergeFi/backend#841 · Filter by author chonilius opened on Nov 12, 2026
  2

• No test asserts that a 429 response carries the fields the frontend's rate-limit handling reads

  testing
  MergeFi/backend#842 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts the encoded XDR for a release invocation, so the argument-type bugs are invisible to the suite

  testing
  MergeFi/backend#840 · Filter by author chonilius opened on Nov 12, 2026
  1

• No test asserts that SorobanClientService.invoke takes the dry-run path, or what it records when it does

  testing
  MergeFi/backend#839 · Filter by author chonilius opened on Nov 12, 2026
  1

• src/auth/decorators/roles.decorator.ts and repo-scoped-sync.decorator.ts have no specs, though both gate authorization

  testing
  MergeFi/backend#838 · Filter by author chonilius opened on Nov 12, 2026
  1

• The eleven NestJS module files have no spec asserting their provider and import wiring

  testing
  MergeFi/backend#837 · Filter by author chonilius opened on Nov 12, 2026
  1

• Node 24 is required here while the frontend builds on 20 and the contracts scripts require 22.12, with no shared .nvmrc policy

  enhancement
  MergeFi/backend#835 · Filter by author chonilius opened on Nov 12, 2026
  1

• The split-percentage check constraints guard each row's range but nothing guards the per-team or per-escrow sum

  enhancement
  MergeFi/backend#836 · Filter by author chonilius opened on Nov 12, 2026
  1

• The backend has no pull-request template, CODEOWNERS or issue templates, unlike the other two repositories

  enhancement
  MergeFi/backend#834 · Filter by author chonilius opened on Nov 12, 2026
  1

• The GitHub Actions in the backend workflow are referenced by floating tags while the frontend pins them to commit SHAs

  security
  MergeFi/backend#833 · Filter by author chonilius opened on Nov 12, 2026
  1

• package.json declares license UNLICENSED and an empty description/author while the sibling repositories declare Apache-2.0

  documentation
  MergeFi/backend#832 · Filter by author chonilius opened on Nov 12, 2026
  1

• .env.example omits GITHUB_SYNC_ALLOWED_REPOS and RUN_SCHEDULERS, both of which change behaviour significantly

  documentation
  MergeFi/backend#831 · Filter by author chonilius opened on Nov 12, 2026
  1

• CI never runs the migrations, so a broken or unordered migration set is only discovered on deploy

  testing
  MergeFi/backend#830 · Filter by author chonilius opened on Nov 12, 2026
  1

• The backend has no dependabot configuration, unlike the contracts and frontend repositories

  security
  MergeFi/backend#829 · Filter by author chonilius opened on Nov 12, 2026
  1