# Findings — Bugs & Improvements (Non-Critical)

## Bugs

### 🟡 Medium

**All medium findings have been fixed.**

### 🟢 Low

**All low-severity bug findings have been fixed.**

| # | Resolution |
|---|------------|
| 12 | Rate limit lowered to 15/min |
| 13 | Model loading wrapped in `Task.start` |
| 14 | Guard boundary changed from `d > -3.0` to `d >= -3.0` |
| 15 | Won't fix — Elixir's `//` is the range step operator; `||` is the correct operator for this pattern. Elixir has no `??` operator |
| 16 | Removed fallback `Repo.get(Station, ...)` — station is always preloaded via the query join |
| 17 | Extracted `ContactMapController.cache_key/0` function; `radio.ex` calls it by name |
| 18 | Added `has_many :contacts` and `has_many :beacons` to `User` schema |

---

## Improvements

### Architecture & Design

**All A&D findings have been fixed.**

| # | Resolution |
|---|------------|
| 4 | Moved `serve_markdown_if_requested` after `put_secure_browser_headers` in the browser pipeline |

### Test Coverage Gaps

| Module | Status | Coverage |
|--------|--------|----------|
| `lib/microwaveprop/ionosphere.ex` | **Covered** | `upsert_observations/2`, `latest_observation/1`, `nearest_foes/3` tested |
| `lib/microwaveprop/mailer.ex` | **Covered** | `apply_defaults/1` tested |
| `lib/microwaveprop/repo.ex` | Not worth testing | Trivial `use Ecto.Repo` one-liner |
| `lib/microwaveprop/space_weather.ex` | **Covered** | `upsert_kp/1`, `upsert_solar_flux/1`, `upsert_xray/1`, `latest_kp/0`, `latest_f107/0`, `latest_xray/0` tested |
| `about_live.ex` | **Covered** | Content rendering and database stats display tested |

### Config & Tooling

**All C&T findings have been fixed.**

| # | Resolution |
|---|------------|
| 1 | `signing_salt` moved to `runtime.exs`, reads from `System.get_env("LIVE_VIEW_SIGNING_SALT", ...)` |
| 2 | Precommit alias uses `deps.unlock --check-unused` |
| 3 | `Credo.Check.Warning.UnsafeToAtom` re-enabled |
| 4 | Considered — left disabled. Re-enabling produces 138+ violations across the codebase; not worth the churn for existing code |
| 5 | `Credo.Check.Warning.LeakyEnvironment` re-enabled |

### Security (Remaining)

| # | Finding | Severity | Status |
|---|---------|----------|--------|
| 1 | `String.to_atom/1` usage — Credo `UnsafeToAtom` now enabled to flag new occurrences | Low | Mitigated |
| 2 | Login rate limit lowered to 15/min | Low | Fixed |
| 3 | `build_contact_changes` in `radio.ex:1277` uses `String.to_existing_atom(key)` — safe due to whitelist, but fragile | Low | Acknowledged |
| 4 | Markdown path now runs after `put_secure_browser_headers` | Low | Fixed |