web: repository browser resolves kind:30618 refs without filtering by relay pubkey
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 78/100
- Issue type
- Bug
- Clarity
- Clearly specified
- Activity status
- Active
- Tech stack
- typescript
Research direction
Start in web/src/features/repos/use-repo-refs.ts at lines 54 and 56, including the existing TODO, then compare how other addressable-event lookups are scoped. Determine whether kind:30618 should use the relay or repository owner's pubkey, and verify that refs from other pubkeys are excluded while the intended authority remains visible.
Written by the indexing model from the issue text.
Description
What's wrong
`web/src/features/repos/use-repo-refs.ts` resolves git ref events (kind:30618) without filtering by the relay's own pubkey. The file has a TODO/comment acknowledging this at the exact lines flagged below.
Impact
Any pubkey can publish a kind:30618 event claiming to be a ref for a repo it doesn't own, and the repo browser will display it as if it were authoritative — a ref-spoofing gap.
Location
web/src/features/repos/use-repo-refs.ts:54,56 (existing TODO comment already documents the gap).
Fix
Scope the query/filter to the relay's own pubkey (or the repo owner's pubkey, whichever is the intended authority for kind:30618 in this repo's NIP), matching how other addressable-event lookups in this codebase are scoped.
Provenance
Found during a documentation-corpus review of launchpad/docs/corpus/platforms/web/repository-browser.md (launchpad-26/buzz PR #1981).
- Dominant language
- Rust
- Stars
- 33.7k
- Forks
- 4.4k
- Avg merge
- 1d 21h
- Merged PRs (30d)
- 239
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from block/buzz
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
workflow_sink's mention parser never masks code regions — @name inside a code span wakes the agent Open
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 Half a day Newbie friendliness 88/100
-
Difficulty 1/5 Under an hour Newbie friendliness 92/100
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100
Eynzof/Hermes-CN-Desktop#610 ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
gitbutlerapp/gitbutler#15998 · 1 comment ·
-
bug triage:deciding
Difficulty 1/5 Under an hour Newbie friendliness 88/100
open-telemetry/otel-arrow#4132 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 84/100