Issues

• [BUG] Floating-point arithmetic used for all financial calculations: risk of balance drift

  pharuq411/Nylepay-Backend#18 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [FEATURE] Add cron job to purge expired refresh tokens: table grows unboundedly

  pharuq411/Nylepay-Backend#17 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [FEATURE] Set up Jest test suite: no tests exist for any financial logic

  pharuq411/Nylepay-Backend#16 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [FEATURE] Implement auto-save cron job: autoSaveEnabled flag has no execution engine

  pharuq411/Nylepay-Backend#15 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [BUG] fundWallet accepts unlimited arbitrary amounts with no min or max validation

  pharuq411/Nylepay-Backend#14 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [FEATURE] Add pagination to GET /notifications (hardcoded limit of 50)

  pharuq411/Nylepay-Backend#13 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [FEATURE] Add input validation: express-validator is installed but never used

  pharuq411/Nylepay-Backend#12 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [FEATURE] Require PIN verification before irreversible financial operations

  pharuq411/Nylepay-Backend#11 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [BUG] Static scrypt salt on Stellar secret key encryption weakens AES-256 protection

  pharuq411/Nylepay-Backend#10 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [FEATURE] Move inline transaction route handlers to a dedicated controller

  pharuq411/Nylepay-Backend#9 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [BUG] Validation chain results are never checked in any controller

  pharuq411/Nylepay-Backend#8 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [BUG] Race condition in crypto buy/sell allows double-spend

  pharuq411/Nylepay-Backend#7 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [BUG] Hardcoded fallback JWT secrets allow trivial token forgery

  pharuq411/Nylepay-Backend#6 · Filter by author derbydaniels9-cpu opened on Jun 21, 2026

• [BUG] Savings interest endpoint is user-accessible — allows unlimited interest farming

  pharuq411/Nylepay-Backend#5 · Filter by author derbydaniels9-cpu opened on Jun 20, 2026

• [FEATURE] Replace hardcoded NGN/USD rate with a live forex feed

  pharuq411/Nylepay-Backend#4 · Filter by author derbydaniels9-cpu opened on Jun 20, 2026

• [FEATURE] Add input validation â€

  pharuq411/Nylepay-Backend#3 · Filter by author derbydaniels9-cpu opened on Jun 20, 2026

• [BUG] Race condition in crypto buy/sell allows double-spend

  pharuq411/Nylepay-Backend#2 · Filter by author derbydaniels9-cpu opened on Jun 20, 2026

• [BUG] Hardcoded fallback JWT secrets allow trivial token forgery

  pharuq411/Nylepay-Backend#1 · Filter by author derbydaniels9-cpu opened on Jun 20, 2026