2026-09-11 - 2026-10-11
Overview
There has not been any commit activity in this period.
4 issues created by 1 user
Opened
#1 Settlement loop has no per-payment error isolation; a malformed zap request drops webhooks and zaps for other paylinks
Opened
#2 webhook_url is unvalidated: server-side POST with attacker-chosen headers to any host (SSRF)
Opened
#3 Nostr-transport create/update bypass the HTTP validation; fiat links created over the transport are served at 1/100 of the configured price
Opened
#4 Lightning-address usernames are not unique: transport create/update skip the check and the schema has no constraint