Issues

• Security vulnerability in SonicJs-Org/sonicjs: please review the report and fix

  area: apibugpriority: P1securitytriage: needs-validation
  Bug

  SonicJs-Org/sonicjs#1125 · Filter by author HieuPenguinnn opened on Oct 22, 2026

• Admin and auth pages load all JS/CSS from third-party CDNs with no SRI, no CSP, and two unpinned versions

  area: adminbugpriority: P1securitytriage: needs-validation
  Bug

  SonicJs-Org/sonicjs#1124 · Filter by author lane711 opened on Oct 22, 2026

• Rate limiter miscounts concurrent requests: KV read-modify-write lets a burst of N count as 1

  area: authbugpriority: P1securitytriage: needs-validation
  Bug

  SonicJs-Org/sonicjs#1123 · Filter by author lane711 opened on Oct 22, 2026

• Add more options for database and object storage

  area: dataenhancementpriority: P3
  Feature

  SonicJs-Org/sonicjs#1102 · Filter by author erikdemarco opened on Sep 30, 2026

• Magic link signs nobody in when the browser has no current 'csrf_token'

  area: authbugpriority: P1
  Bug

  SonicJs-Org/sonicjs#1101 · Filter by author mmcintosh opened on Sep 22, 2026

• ResendProvider cannot send on Workers: unbound fetch stored as an instance property throws "Illegal invocation"

  area: emailbugpriority: P1
  Bug

  SonicJs-Org/sonicjs#1099 · Filter by author elpastiche opened on Sep 14, 2026

• Email plugin settings are never read: loadDbEmailSettings queries a v2 plugins table that does not exist in v3

  area: emailbugpriority: P1
  Bug

  SonicJs-Org/sonicjs#1098 · Filter by author elpastiche opened on Sep 14, 2026

• Redirect Management Plugin - GET /api/redirects returns a 404

  area: pluginsbugpriority: P2
  Bug

  SonicJs-Org/sonicjs#1067 · Filter by author jimmaaay opened on Aug 24, 2026

• Can't login as admin in production

  area: authbugpriority: P1
  Bug

  SonicJs-Org/sonicjs#1054 · Filter by author hankeyyh opened on Aug 14, 2026
  3

• [Vulnerability] Hardcoded JWT Secret May Lead to Privilege Escalation Risks

  area: authbugpriority: P1securitytriage: needs-validation
  Bug

  SonicJs-Org/sonicjs#1043 · Filter by author lx915 opened on Jul 25, 2026

• security: slug-validate field_name on write to close fieldId XSS sink

  area: adminbugpriority: P1securitytriage: needs-validation
  Bug

  SonicJs-Org/sonicjs#1031 · Filter by author lane711 opened on Jul 24, 2026

• beta.25 cold-start caches break outside a Workers isolate — ~25 core unit tests fail on a clean checkout

  area: qualitybugpriority: P1testing
  Bug

  SonicJs-Org/sonicjs#1016 · Filter by author mmcintosh opened on Jul 20, 2026
  

• fix: reconcile code-defined collection types on cached bootstrap

  area: databugpriority: P1
  Bug

  SonicJs-Org/sonicjs#1014 · Filter by author bobbwal opened on Jul 19, 2026

• docs: website advertises v3.0.0-beta.24 after v3.0.0-beta.25 release

  area: documentationbugdocumentationpriority: P2
  Bug

  SonicJs-Org/sonicjs#1012 · Filter by author bobbwal opened on Jul 18, 2026

• npm ci fails on main: package-lock.json is out of sync with package.json

  area: developer-experiencebugmaintenancepriority: P1
  Bug

  SonicJs-Org/sonicjs#1011 · Filter by author bobbwal opened on Jul 18, 2026

• [3.0.0-beta.17] SonicJSConfig disabled plugins show in Sidebar

  area: pluginsbugpriority: P2
  Bug

  SonicJs-Org/sonicjs#971 · Filter by author LukeSeers opened on Jun 29, 2026

• [3.0.0-beta.17] SonicJSConfig plugins register uninstall plugin

  area: pluginsbugpriority: P2
  Bug

  SonicJs-Org/sonicjs#970 · Filter by author LukeSeers opened on Jun 29, 2026

• Evaluate: User Preferences API (cross-collection isolation)

  area: apienhancementpriority: P3questiontriage: needs-validation
  Task

  SonicJs-Org/sonicjs#962 · Filter by author lane711 opened on Jun 26, 2026

• Auth robustness tests: login transaction safety + refresh freshness

  area: authenhancementpriority: P2testing
  Task

  SonicJs-Org/sonicjs#961 · Filter by author lane711 opened on Jun 26, 2026

• Session lifecycle: deeper invariant tests (expiry cleanup, refresh, updatedAt)

  area: authenhancementpriority: P2testing
  Task

  SonicJs-Org/sonicjs#960 · Filter by author lane711 opened on Jun 26, 2026
  1

• Account lockout: login-path integration + admin unlock tests

  area: authenhancementpriority: P2securitytesting
  Task

  SonicJs-Org/sonicjs#959 · Filter by author lane711 opened on Jun 26, 2026

• Per-user disableLocalStrategy (SSO-only accounts)

  area: authenhancementpriority: P2security
  Feature

  SonicJs-Org/sonicjs#958 · Filter by author lane711 opened on Jun 26, 2026

• Email verification flow (verify endpoint + login gating)

  area: authenhancementpriority: P2security
  Feature

  SonicJs-Org/sonicjs#957 · Filter by author lane711 opened on Jun 26, 2026

• [v3 bug]: Create folder action error

  area: mediabugpriority: P2triage: needs-info
  Bug

  SonicJs-Org/sonicjs#929 · Filter by author miljan-aleksic opened on Jun 19, 2026

• [v3 feat]: Support for wrangler.jsonc

  area: developer-experienceenhancementpriority: P2
  Feature

  SonicJs-Org/sonicjs#928 · Filter by author miljan-aleksic opened on Jun 19, 2026