Issues

• [low] start-*.sh unsafe 'export $(cat .env | xargs)' env load

  area: configpriority: lowtype: bug
  cativo23/nova-id#117 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 8 — Cleanup, dead code & scripts hygiene

• [low] useAuditLog composable never invoked

  area: frontendpriority: lowtype: bug
  cativo23/nova-id#116 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 8 — Cleanup, dead code & scripts hygiene

• [low] Dead isAuthenticated state; nav visibility is path-only

  area: frontendpriority: lowtype: bug
  cativo23/nova-id#115 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 8 — Cleanup, dead code & scripts hygiene

• [low] Dead roleOptions + hardcoded hidden traits.role input (escalation landmine)

  area: frontendpriority: lowsecuritytype: security
  cativo23/nova-id#114 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 8 — Cleanup, dead code & scripts hygiene

• [low] Challenge-token DTOs inconsistently length-bounded

  area: apiarea: oauthpriority: lowtype: bug
  cativo23/nova-id#113 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 8 — Cleanup, dead code & scripts hygiene

• [low] AuthModule exported guard is dead; AppModule builds a second instance

  area: apipriority: lowtype: bug
  cativo23/nova-id#112 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 8 — Cleanup, dead code & scripts hygiene

• [medium] make setup-permissions points to nonexistent script

  area: configpriority: mediumtype: bug
  cativo23/nova-id#111 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 8 — Cleanup, dead code & scripts hygiene

• [medium] generate-env.sh omits DEMO_DB_PASSWORD -> empty password

  area: configpriority: mediumtype: bug
  cativo23/nova-id#110 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 8 — Cleanup, dead code & scripts hygiene

• [high] .env.production.example missing audit-role vars + stale superuser note

  area: configpriority: hightype: bug
  cativo23/nova-id#109 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 8 — Cleanup, dead code & scripts hygiene

• [low] Role DTOs accept any string as userId (no UUID validation)

  area: apipriority: lowtype: bug
  cativo23/nova-id#108 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 7 — demo-api service

• [low] LoggingInterceptor crashes on undefined/non-serializable body

  area: apipriority: lowtype: bug
  cativo23/nova-id#107 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 7 — demo-api service

• [medium] User emails stored cleartext in logs, readable by app_admin

  area: apipriority: mediumsecuritytype: security
  cativo23/nova-id#106 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 7 — demo-api service

• [medium] demo-api audit write failures swallowed -> reports success on failed audit

  area: apipriority: mediumsecuritytype: security
  cativo23/nova-id#105 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 7 — demo-api service

• [medium] Log rotation overwrites previous rotated file -> history lost

  area: apipriority: mediumtype: bug
  cativo23/nova-id#104 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 7 — demo-api service

• [high] Two LogsService singletons -> role grant/revoke never appears in /logs

  area: apipriority: hightype: bug
  cativo23/nova-id#103 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 7 — demo-api service

• [gray] Overly broad invalid_grant swallowing hides genuine callback failures

  area: frontendarea: oauthpriority: lowquestiontype: bug
  cativo23/nova-id#102 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 6 — Frontend flows & OIDC hardening

• [gray] 'View permissions' row action always shows the admin's own permissions

  area: frontendpriority: mediumquestiontype: bug
  cativo23/nova-id#101 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 6 — Frontend flows & OIDC hardening

• [low] Verification 'Continue' href bypasses safeRedirect()

  area: frontendpriority: lowsecuritytype: security
  cativo23/nova-id#100 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 6 — Frontend flows & OIDC hardening

• [medium] Nonce replay check skipped when id_token omits nonce

  area: frontendarea: oauthpriority: mediumsecuritytype: security
  cativo23/nova-id#99 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 6 — Frontend flows & OIDC hardening

• [medium] ID token signature never cryptographically verified

  area: frontendarea: oauthpriority: mediumsecuritytype: security
  cativo23/nova-id#98 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 6 — Frontend flows & OIDC hardening

• [high] Admin permission cache fetched once, never invalidated -> revoked admin keeps access

  area: frontendarea: ketopriority: highsecuritytype: security
  cativo23/nova-id#97 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 6 — Frontend flows & OIDC hardening

• [high] Post-success redirect to nonexistent /dashboard route -> blank page

  area: frontendpriority: hightype: bug
  cativo23/nova-id#96 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 6 — Frontend flows & OIDC hardening

• [high] /logs unreachable — Bearer token never attached, gateway always 401s

  area: frontendarea: oauthpriority: hightype: bug
  cativo23/nova-id#95 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 6 — Frontend flows & OIDC hardening

• [low] updateIdentity/setIdentityState read-then-replace -> lost updates

  area: apipriority: lowtype: bug
  cativo23/nova-id#94 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 5 — Audit trail integrity

• [medium] Winston file logger: no rotation, no PHI/secret redaction

  area: apipriority: mediumsecuritytype: security
  cativo23/nova-id#93 · Filter by author cativo23 opened on Jul 7, 2026 · Wave 5 — Audit trail integrity