Issues

• [Wave 200pts] FIX: Per-user rate limiter reads req.user.id while JwtAuthGuard sets sub, so limits never apply

  backend
  Nexacore-Org/NexaFx-js#1469 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Admin-configured endpoint rate limits are never enforced; unique(endpoint) blocks per-method rules

  backend
  Nexacore-Org/NexaFx-js#1468 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: AuditExportService is never registered or exposed, and its 'csv' format emits JSON lines

  backend
  Nexacore-Org/NexaFx-js#1467 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] SECURITY: Ticket owners can reassign their own support tickets and set arbitrary statuses

  backend
  Nexacore-Org/NexaFx-js#1466 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: AML screening applies fixed thresholds to raw amounts in any currency; reviews have no outcome

  backend
  Nexacore-Org/NexaFx-js#1465 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: AML structuring, smurfing and velocity rules are never invoked by any transaction flow

  backend
  Nexacore-Org/NexaFx-js#1464 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Triggered rate alerts are never recorded in history or notified; RateAlertsModule can't boot

  backend
  Nexacore-Org/NexaFx-js#1463 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] SECURITY: Idempotency keys are global and unreserved — concurrent retries double-execute

  backend
  Nexacore-Org/NexaFx-js#1462 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: ReferralService.rewardReferral can double-pay under concurrency and always credits USD

  backend
  Nexacore-Org/NexaFx-js#1461 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Applying a referral code overwrites the previous referee and resets REWARDED to PENDING

  backend
  Nexacore-Org/NexaFx-js#1460 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Activity feed misses logins, KYC, profile, swap, reversal and incoming-transfer activity

  backend
  Nexacore-Org/NexaFx-js#1459 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Statement PDF truncates to 20 lines on a single page and labels every amount as EUR

  backend
  Nexacore-Org/NexaFx-js#1458 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Statements over 31 days are queued and generated, then discarded with no way to retrieve them

  backend
  Nexacore-Org/NexaFx-js#1457 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] PERF: Statements load a user's entire transaction and FX history twice and filter dates in memory

  backend
  Nexacore-Org/NexaFx-js#1456 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Account statements show deposits as debits, omit fees and never show swap proceeds

  backend
  Nexacore-Org/NexaFx-js#1455 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Scheduled report runner runs on every replica, drifts its schedule and accepts unvalidated input

  backend
  Nexacore-Org/NexaFx-js#1454 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Mail .hbs templates are not copied to dist, so MailService.render* throws ENOENT in production

  backend
  Nexacore-Org/NexaFx-js#1453 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: email-queue never retries or dead-letters because MailProcessor swallows SMTP errors

  backend
  Nexacore-Org/NexaFx-js#1452 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: Six user-facing MailService send methods only log — no statement/reversal/ticket/export emails

  backend
  Nexacore-Org/NexaFx-js#1451 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] SECURITY: POST /devices/register silently rebinds another user's push token to the caller

  backend
  Nexacore-Org/NexaFx-js#1450 · Filter by author portableDD opened on Oct 8, 2026

• [Wave 200pts] FIX: NotificationBatchingService drops batched transactions and never sends email batches

  backend
  Nexacore-Org/NexaFx-js#1449 · Filter by author portableDD opened on Oct 8, 2026