Skip to content

What the review found — and deliberately left for later

Technical version: WING-404 — council findings NOT fixed in the initial commit

After a multi-model code review (Grok, Codex, Gemini) on 2026-08-06, some issues were fixed in the same change set and some were real but deferred. This page is the plain map of the deferred list so nothing is mistaken for “dismissed.”

Already fixed in that work (context)

Examples: channel lost on save, false “Saved” on failure, empty Adzuna lists when enrichment overran budget, stale search results overwriting newer ones, saving while ATS resolution was still pending, and a null ATS field that could crash the server.

Deferred high-severity items (plain language)

DNS rebinding risk on the URL resolver. The app checks that a hostname looks public, then the HTTP stack may resolve the name again when connecting. A hostile hostname could answer “public” first and “private/internal” later. User-supplied URLs on the resolve endpoint raise the stakes. Fix needs a pinned connection to the validated address, re-check on redirects, and a real rebinding test — too important to sneak into a tired feature commit.

No strong per-user rate limit on the outbound resolve endpoint. Partial mitigations exist (URL size cap, host rate, global concurrency). A true per-token limiter and bulk import cap were still missing at defer time.

Deferred medium items (plain language)

  • Public-IP checks missing some special IANA ranges and IPv6 transition encodings
  • Full sensitive URLs (including tracker tokens) in default HTTP logs and caches
  • Adzuna mapper hardcoding the wrong “channel” for background sync
  • Imported jobs saving as “Untitled / Unknown company” because host-only resolution never reads title/company from the page
  • Cancelled import rows marked as successfully “done”
  • Large paste lists doing expensive work in the UI for every keystroke

Why defer instead of ignore

Security and shared infrastructure fixes need their own ticket, review, and proof. Shipping them unverified at 4 a.m. is how security theater happens.