Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Code review 2026-09-09: fix PRs and deferred findings (tracking)

Open
  • Is something wrong?
#304 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
20/100
Issue type
Documentation
Clarity
Needs clarification
Activity status
Active
Tech stack
android, csharp, sqlite
Domain
devtools, performance, security

Research direction

This is a tracking issue summarizing completed fixes and deferred findings, not a request for a specific change. Read the linked issues #288–#302 to find an individual task with a defined scope; this issue itself has no implementation entry point or completion criteria.

Written by the indexing model from the issue text.

Description

enhancement

Tracking issue for the senior architecture / security / performance review of main at 35d86e1 (2026-09-09). Earlier audit for context: #167.

Overall verdict: a well-engineered codebase with a few sharp, high-consequence defects. Domain is dependency-free, the reference graph is acyclic, warnings-as-errors + AnalysisMode=All + StyleCop are enforced everywhere, every analyzer suppression carries a justification, SQL values are fully parameterised, actions are SHA-pinned, and the sync protocol uses a closed [JsonDerivedType] allowlist. The problems were concentrated in persistence correctness, error observability, lifecycle management and a few security edges on the sync / attachment path.

Fix PRs (each with a regression test that failed on main first)

Prio Finding PR
P0 force_unit_edits never deleted on save → Stärke history duplicated on every save, file grows quadratically #279
P0 IIncidentStore.SaveFailed had no subscriber → disk-full / locked / corrupt-DB failures were invisible while the UI said "gespeichert" #280
P0 Workspace never disposed on navigate-home → abandoned workspaces kept ticking, could still write journal entries and play alarms #284
P1 Remote-supplied attachment name reached a temp path and the OS launcher (path traversal + type confusion across peers) #285
P1 Trust store read race on the TLS callback, non-atomic write, dead accept-any-certificate branch #286
P1 CI token not read-only; @claude workflow triggerable by anyone with contents: write; format-check not in CI; Dependabot gaps #287
P1 Android FileProvider exposed the whole cache dir; provider display names used verbatim as path segments #303

Suggested merge order: #287 first (CI), then #279, #280, #284 (independent), then #285 before the Android PR (the Android PR is robust to either order, but #289 assumes #285).

Deferred findings, filed as issues

  • Security: #288 (sync host: 6-digit PIN, SAN, fingerprint), #289 (Android attachment gate + temp janitor)
  • Performance: #290 (coalesce saves), #291 (recent-file probes on UI thread), #292 (quadratic BuildMatrix), #293 (checklist O(N²) fan-out), #294 (Clear+re-add resets), #295 (sync fire-and-forget), #296 (audio queue timeout)
  • Architecture: #297 (MasterDataSet out of Persistence), #298 (session port location + 5-file ceremony), #299 (Incident aggregate + German text in Domain), #300 (logging + global exception handlers)
  • Hygiene: #301 (coverage, deterministic builds, AnalysisLevel, changelog enforcement), #302 (small cleanups checklist)

Items in #167 that this review re-confirmed as still open: Local/Remote session lockstep (#298), DispatcherTimerTicker subscriber isolation and unbounded remote file cache (#302), BuildChildren full rebuild (#294).

Dominant language
C#
Stars
1
Forks
3
Avg merge
4h 49m
Merged PRs (30d)
177

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from CodeForFire/lagebuch

All issues in CodeForFire/lagebuch

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.