Issues

• Nobody can ask for a new confirmation email: both Resend controls need a session an unconfirmed address never gets

  TortoiseWolfe/ScriptHammer#1352 · Filter by author TortoiseWolfe opened on Oct 11, 2026

• Remove the auth-token removal guard and the spurious-SIGNED_OUT heuristic: since auth-js 2.117 they only block real sign-outs

  TortoiseWolfe/ScriptHammer#1351 · Filter by author TortoiseWolfe opened on Oct 11, 2026

• A PENDING PayPal capture reads as failed, so the buyer can pay again by card before it settles

  TortoiseWolfe/ScriptHammer#1349 · Filter by author TortoiseWolfe opened on Oct 11, 2026

• Lead scripthammer.com with the web studio, not the template pitch

  enhancement
  TortoiseWolfe/ScriptHammer#1327 · Filter by author TortoiseWolfe opened on Oct 9, 2026
  1

• tracking: 32 RescueDogs review findings that live in ScriptHammer code (fix here once, sync down)

  TortoiseWolfe/ScriptHammer#1311 · Filter by author TortoiseWolfe opened on Sep 30, 2026

• Account deletion fails for anyone who ever checked out, after the client has already deleted their message keys

  bugpriority:p0
  TortoiseWolfe/ScriptHammer#1309 · Filter by author TortoiseWolfe opened on Sep 29, 2026

• River bridges (Walnut Street, Market Street, Olgiati, Veterans): stake and model; Walnut Street photo-matched (wb003)

  TortoiseWolfe/ScriptHammer#1305 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• Group messages are accepted under a stale key version: refuse them server-side (#1247 B3)

  TortoiseWolfe/ScriptHammer#1301 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• Car Barns (1886, Market & W 3rd): model the CARTA bus barn as it stood in 1978, replace 300-market-street, spawn there

  3dpriority:p2
  TortoiseWolfe/ScriptHammer#1290 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• [EPIC] Replace the 129 Warehouse models with own-authored SketchUp buildings — historic Chattanooga first

  3depicpriority:p2
  TortoiseWolfe/ScriptHammer#1289 · Filter by author TortoiseWolfe opened on Sep 24, 2026

• Tailwind scans the whole repo, so strings in tests/ and scripts/ ship as production CSS and change stylesheet hashes

  TortoiseWolfe/ScriptHammer#1279 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Dead code: eight unused modules, deprecated test-only exports, 24 unreferenced scripts, and fourteen Storybook-only components that need a call

  TortoiseWolfe/ScriptHammer#1265 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Test infrastructure: Deno tests nothing runs, two tests disabled by rename, a global mock where every write succeeds, coverage excludes that hide tested code

  TortoiseWolfe/ScriptHammer#1263 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Offline/PWA layer: two components fight over the install prompt, the service worker re-installs on every page load, a failed message loops the sync

  TortoiseWolfe/ScriptHammer#1262 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Three TODOs in shipped code whose surrounding output claims the feature works: subscription retry moves no money, webhook-retry script retries nothing

  TortoiseWolfe/ScriptHammer#1261 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Edge Functions carry five copies of getPayPalAccessToken and two divergent timingSafeEqual implementations

  TortoiseWolfe/ScriptHammer#1260 · Filter by author TortoiseWolfe opened on Sep 23, 2026
  1

• No ceiling on message size, send rate, friend requests, uploads or payment intents for a signed-in account; admin-DM forgery is by design and undocumented as such

  TortoiseWolfe/ScriptHammer#1254 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Messaging reloads everything on a 10-second timer and on every event instead of subscribing to the row that changed

  TortoiseWolfe/ScriptHammer#1253 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• avatar_url accepts any URL, turning every profile view into a tracking beacon — and the obvious fix breaks OAuth avatars

  TortoiseWolfe/ScriptHammer#1252 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Device-side key lifecycle: session mode still persists the private key, group keys are extractable, and three smaller gaps

  TortoiseWolfe/ScriptHammer#1251 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Production auth config: localhost in the redirect allow-list, OTP verify limit raised to 100, no re-auth for password change, server minimum password 6

  TortoiseWolfe/ScriptHammer#1250 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Migration hygiene: three payment tables skip REVOKE-first, definers omit pg_temp, and the schema seeds a confirmed test account

  TortoiseWolfe/ScriptHammer#1249 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• The production admin account is seeded with a password committed to the public repo, and a test signs in with it

  TortoiseWolfe/ScriptHammer#1246 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• Limiter and oracle definers were anon-callable: A1+A2 fixed and live; A3 (Edge Functions to consume_rate_limit) and A4 (final revoke) remain

  TortoiseWolfe/ScriptHammer#1245 · Filter by author TortoiseWolfe opened on Sep 23, 2026

• The webhook liveness alarm cannot tell a misconfigured provider from a refused forgery, and asserts the first

  bug
  TortoiseWolfe/ScriptHammer#1231 · Filter by author TortoiseWolfe opened on Sep 23, 2026