Graham McIntire
316fb2fbc7
- Bug #12: Lower rate limit to 15/min - Bug #13: Wrap model loading in Task.start - Bug #14: Fix classify_time_period guard gap at -3.0 - Bug #15: Not applicable (Elixir has no ?? operator) - Bug #16: Remove fallback Repo.get for station preload - Bug #17: Extract cache_key() in ContactMapController - Bug #18: Add has_many :contacts and :beacons to User schema - A&D #4: Move serve_markdown_if_requested after secure headers - Config #1: Move signing_salt to runtime.exs env var - Config #2: Use --check-unused instead of --unused - Config #3: Re-enable UnsafeToAtom Credo check - Config #5: Re-enable LeakyEnvironment Credo check - Add @spec annotations to fix re-enabled Specs violations - Replace String.to_atom with to_existing_atom where guarded
2.3 KiB
2.3 KiB
Findings — Bugs & Improvements (Non-Critical)
Bugs
🟡 Medium
All medium findings have been fixed.
🟢 Low
All low-severity bug findings have been fixed.
| # | Resolution |
|---|---|
| 12 | Rate limit lowered to 15/min |
| 13 | Model loading wrapped in Task.start |
| 14 | Guard boundary changed from d > -3.0 to d >= -3.0 |
| 15 | Won't fix — Elixir's // is the range step operator; ` |
| 16 | Removed fallback Repo.get(Station, ...) — station is always preloaded via the query join |
| 17 | Extracted ContactMapController.cache_key/0 function; radio.ex calls it by name |
| 18 | Added has_many :contacts and has_many :beacons to User schema |
Improvements
Architecture & Design
All A&D findings have been fixed.
| # | Resolution |
|---|---|
| 4 | Moved serve_markdown_if_requested after put_secure_browser_headers in the browser pipeline |
Test Coverage Gaps
| Module | Status |
|---|---|
lib/microwaveprop/ionosphere.ex |
Untested |
lib/microwaveprop/mailer.ex |
Untested |
lib/microwaveprop/repo.ex |
Untested |
lib/microwaveprop/space_weather.ex |
Untested |
about_live.ex |
Real DB query logic, untested |
Config & Tooling
All C&T findings have been fixed.
| # | Resolution |
|---|---|
| 1 | signing_salt moved to runtime.exs, reads from System.get_env("LIVE_VIEW_SIGNING_SALT", ...) |
| 2 | Precommit alias uses deps.unlock --check-unused |
| 3 | Credo.Check.Warning.UnsafeToAtom re-enabled |
| 4 | Considered — left disabled. Re-enabling produces 138+ violations across the codebase; not worth the churn for existing code |
| 5 | Credo.Check.Warning.LeakyEnvironment re-enabled |
Security (Remaining)
| # | Finding | Severity | Status |
|---|---|---|---|
| 1 | String.to_atom/1 usage — Credo UnsafeToAtom now enabled to flag new occurrences |
Low | Mitigated |
| 2 | Login rate limit lowered to 15/min | Low | Fixed |
| 3 | build_contact_changes in radio.ex:1277 uses String.to_existing_atom(key) — safe due to whitelist, but fragile |
Low | Acknowledged |
| 4 | Markdown path now runs after put_secure_browser_headers |
Low | Fixed |