Search results

OTP send endpoint returns success even when email delivery fails

bugSomething isn't workingSomething isn't working

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#70 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Security: Message API has no authentication — unauthenticated sender impersonation possible

advancedComplex issues requiring experienced contributorsComplex issues requiring experienced contributors

bugSomething isn't workingSomething isn't working

securitysecurity d73a4a 'Security vulnerability'security d73a4a 'Security vulnerability'

Status: Open.

#69 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Security: Admin password hashing disabled — plaintext passwords stored in database

advancedComplex issues requiring experienced contributorsComplex issues requiring experienced contributors

bugSomething isn't workingSomething isn't working

securitysecurity d73a4a 'Security vulnerability'security d73a4a 'Security vulnerability'

Status: Open.

#68 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Admin analytics dashboard crashes — imports non-existent Student and Faculty models

bugSomething isn't workingSomething isn't working

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#67 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Runtime crash: Wishlist endpoint hits MissingSchemaError for unregistered 'Student' model

bugSomething isn't workingSomething isn't working

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#66 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Runtime crash: Wishlist endpoint hits MissingSchemaError for unregistered 'Student' model

bugSomething isn't workingSomething isn't working

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#65 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Feature: Add institutional email verification with verified badge system

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#64 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

No institutional email domain validation allows any email address to register

bugSomething isn't workingSomething isn't working

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#63 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Chat message GET endpoints missing participant authorization check

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#62 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Marketplace listing submission is a client-side stub — images collected but never uploaded

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#61 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Supabase auth metadata role is user-controlled with no server-side enforcement

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#60 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026

Profiles table RLS policy exposes all sensitive fields (CGPA, phone, whatsapp) to any authenticated user

help wantedExtra attention is neededExtra attention is needed

Status: Open.

#59 In OpenLake/Smart-Insti-App;

· amaydixit11 opened on Apr 6, 2026