Issues

• [Bug] file-helper Check File Type: single-select dropdown makes includes() a substring match — .3gp files pass a video/3gpp2 filter

  Mihir-Rabari/inboxfm-connect#557 · Filter by author Meet-4 opened on Oct 12, 2026

• fix(pieces): guard piece-install archive cleanup against redlock release-time rejection

  Mihir-Rabari/inboxfm-connect#555 · Filter by author Mihir-Rabari opened on Oct 11, 2026

• tests(security): SSRF AST-scanner hardening follow-ups (from #551 review)

  Mihir-Rabari/inboxfm-connect#554 · Filter by author Mihir-Rabari opened on Oct 11, 2026

• Connect flow totally broken: watcher returns bare engine result but callers expect EngineResponse envelope — all API-key connects 400 even with valid credentials

  area:enginearea:serverbug
  Mihir-Rabari/inboxfm-connect#548 · Filter by author Mihir-Rabari opened on Oct 10, 2026

• MCP server config stores a static token that /mcp rejects (401) — dead credential field

  area:serverbug
  Mihir-Rabari/inboxfm-connect#547 · Filter by author Mihir-Rabari opened on Oct 10, 2026

• MISSING connection status is misleading — bare label, no reconnect CTA, and actions still execute on MISSING connections

  area:productarea:webbug
  Mihir-Rabari/inboxfm-connect#546 · Filter by author Mihir-Rabari opened on Oct 10, 2026

• Duplicate AI-provider create leaks raw 500 (PG 23505) instead of returning 409 conflict

  area:serverbug
  Mihir-Rabari/inboxfm-connect#545 · Filter by author Mihir-Rabari opened on Oct 10, 2026

• MCP ap_run_action: pieces using context.store crash with "Invalid URL" — headless action context drops engineToken/internalApiUrl

  area:enginebug
  Mihir-Rabari/inboxfm-connect#544 · Filter by author Mihir-Rabari opened on Oct 10, 2026

• Connections API requires projectId that the web client omits — fresh sessions get opaque 400s; backend error details are swallowed

  area:serverarea:webbug
  Mihir-Rabari/inboxfm-connect#543 · Filter by author Mihir-Rabari opened on Oct 10, 2026

• [Bug] execution-event memory fallback leaks its live history array - concurrent emit mutates the SSE backfill response

  Mihir-Rabari/inboxfm-connect#519 · Filter by author Rakshit-Sapariya opened on Oct 4, 2026

• [Bug] connect-oauth-app re-upsert rotates the row primary key — the id from the first upsert stops resolving (CE twin of #467)

  Mihir-Rabari/inboxfm-connect#515 · Filter by author atharvashukla098-tech opened on Oct 3, 2026

• [Bug] projectRoleService.create races on role name and returns ENTITY_NOT_FOUND for a duplicate

  Mihir-Rabari/inboxfm-connect#513 · Filter by author atharvashukla098-tech opened on Oct 3, 2026

• [Bug] projectRoleService.create races on role name and returns ENTITY_NOT_FOUND for a duplicate

  Mihir-Rabari/inboxfm-connect#512 · Filter by author Rakshit-Sapariya opened on Oct 3, 2026
  1

• [Bug] userService.getOrCreateWithProject races on idx_user_platform_id_email and 500s on sign-in

  Mihir-Rabari/inboxfm-connect#509 · Filter by author Rakshit-Sapariya opened on Oct 3, 2026

• fix(project-replace): provider mappings are not persisted in the signed plan artifact, so apply silently targets the source provider

  Mihir-Rabari/inboxfm-connect#502 · Filter by author atharvashukla098-tech opened on Oct 3, 2026

• tsconfig.base.json uses removed compiler options (baseUrl, moduleResolution: node) so every package tsconfig fails to load

  Mihir-Rabari/inboxfm-connect#495 · Filter by author atharvashukla098-tech opened on Oct 3, 2026
  2

• /list-agents stopped working: Retell AI switched it off (July 31, 2026)

  Mihir-Rabari/inboxfm-connect#477 · Filter by author 23821 opened on Oct 2, 2026

• [Bug] Concurrent POST /v1/integrations installs of the same piece: loser gets a raw unique-violation mislabeled ENGINE_OPERATION_FAILURE + leaks its uploaded archive

  Mihir-Rabari/inboxfm-connect#475 · Filter by author iamwinter1116-void opened on Oct 2, 2026

• Bug: concurrent first-time AI tool configuration returns 500 (find-then-save race on ai_tool_config)

  Mihir-Rabari/inboxfm-connect#473 · Filter by author iamwinter1116-void opened on Oct 2, 2026

• [Bug] GET /v1/ai-providers find-then-create race on the managed-provider auto-create — concurrent first list calls 500/409 via the (platformId, provider) unique index

  Mihir-Rabari/inboxfm-connect#471 · Filter by author iamwinter1116-void opened on Oct 2, 2026

• [Bug] Managed-authn /external-token: three find-then-create races 500 on concurrent logins (project / identity / user unique indexes)

  Mihir-Rabari/inboxfm-connect#469 · Filter by author iamwinter1116-void opened on Oct 2, 2026

• [Security] POST /v1/execute trusts client-supplied connectionId — cross-project credential use with no ownership check

  Mihir-Rabari/inboxfm-connect#363 · Filter by author iamwinter1116-void opened on Sep 29, 2026
  1

• [Security] GET /v1/app-credentials is public — cross-tenant OAuth client_id enumeration for any projectId

  Mihir-Rabari/inboxfm-connect#358 · Filter by author iamwinter1116-void opened on Sep 29, 2026
  2

• [Security] Public /v1/license-keys/verify lets any caller overwrite any platform's plan (cross-tenant, no ownership check)

  Mihir-Rabari/inboxfm-connect#354 · Filter by author iamwinter1116-void opened on Sep 29, 2026
  1

• Unauthenticated trigger-binding run ingress: no rate limit, unbounded body — unlimited LLM-execution farming from a leaked URL

  Mihir-Rabari/inboxfm-connect#351 · Filter by author iamwinter1116-void opened on Sep 29, 2026
  1