Issues

• Concurrent cmd_get_ticket / cmd_make_code can create two docs for one folder

  bug
  claudiorrrr/syncbox#16 · Filter by author claudiorrrr opened on May 21, 2026

• Menu Quit bypasses shutdown_all (no graceful sync stop)

  bug
  claudiorrrr/syncbox#15 · Filter by author claudiorrrr opened on May 21, 2026

• Inner::folder_mut is bypassed by direct inner.folders[idx] indexing

  tech-debt
  claudiorrrr/syncbox#14 · Filter by author claudiorrrr opened on May 21, 2026

• Peer-persister task leaks on folder remove + re-add

  bug
  claudiorrrr/syncbox#13 · Filter by author claudiorrrr opened on May 21, 2026

• Frontend: refresh() can overlap, navigator.clipboard errors silent

  bug
  claudiorrrr/syncbox#12 · Filter by author claudiorrrr opened on May 21, 2026

• Refactor: cmd_get_ticket and cmd_make_code duplicate doc-share block

  tech-debt
  claudiorrrr/syncbox#11 · Filter by author claudiorrrr opened on May 21, 2026

• update_item Mutex .unwrap() can panic the app

  bug
  claudiorrrr/syncbox#10 · Filter by author claudiorrrr opened on May 21, 2026

• Tray-updater loop holds Inner mutex across per-folder stats await

  bugtech-debt
  claudiorrrr/syncbox#9 · Filter by author claudiorrrr opened on May 21, 2026

• Echo guard entries never expire

  bugtech-debt
  claudiorrrr/syncbox#8 · Filter by author claudiorrrr opened on May 21, 2026

• fp_cache grows unbounded; never prunes deleted files

  bugtech-debt
  claudiorrrr/syncbox#7 · Filter by author claudiorrrr opened on May 21, 2026

• Webview CSP is null — add a baseline Content-Security-Policy

  enhancementsecurity
  claudiorrrr/syncbox#6 · Filter by author claudiorrrr opened on May 21, 2026

• Data dir created with world-readable perms (0o755)

  bugsecurity
  claudiorrrr/syncbox#5 · Filter by author claudiorrrr opened on May 21, 2026

• Pair-server: no rate limiting on POST/GET, codes are enumerable

  enhancementsecurity
  claudiorrrr/syncbox#4 · Filter by author claudiorrrr opened on May 21, 2026

• Pair-server: KV read+delete is not atomic, ticket can be redeemed twice

  bugsecurity
  claudiorrrr/syncbox#3 · Filter by author claudiorrrr opened on May 21, 2026

• Symlink traversal in write_entry_to_disk and apply_remote_delete

  bugsecurity
  claudiorrrr/syncbox#2 · Filter by author claudiorrrr opened on May 21, 2026

• SSRF: cmd_set_pair_server accepts any URL

  bugsecurity
  claudiorrrr/syncbox#1 · Filter by author claudiorrrr opened on May 21, 2026