Issues

• nginx error_log still records client addresses, and no compose file rotates logs

  security
  Flatts3000/relay#77 · Filter by author Flatts3000 opened on Aug 30, 2026

• The public directory is gated behind hub verification, so it cannot ship before a hub partner does

  enhancementno-grind
  Flatts3000/relay#61 · Filter by author Flatts3000 opened on Aug 30, 2026
  2

• Broadcast invites are not padded, so the invite count reveals how many groups matched

  blockedsecurity
  Flatts3000/relay#57 · Filter by author Flatts3000 opened on Aug 29, 2026
  2

• Broadcast tombstone records only the last recipient group, not all of them

  bugno-grind
  Flatts3000/relay#31 · Filter by author Flatts3000 opened on Aug 28, 2026

• broadcast_tombstones retains request metadata indefinitely with no prune path

  no-grindpriority: highsecurity
  Flatts3000/relay#29 · Filter by author Flatts3000 opened on Aug 28, 2026

• Security, privacy and terms copy still describes the removed mailbox model

  documentationno-grindpriority: highsecurity
  Flatts3000/relay#27 · Filter by author Flatts3000 opened on Aug 28, 2026

• Record the completed independent cryptography review in docs/security_audit.md

  blockeddocumentationsecurity
  Flatts3000/relay#14 · Filter by author Flatts3000 opened on Aug 28, 2026
  1

• Aggregate success metrics are not implemented

  blockedenhancement
  Flatts3000/relay#13 · Filter by author Flatts3000 opened on Aug 28, 2026

• GDPR and COPPA evaluation outstanding; no documented retention policy

  complianceno-grind
  Flatts3000/relay#12 · Filter by author Flatts3000 opened on Aug 28, 2026

• Test coverage sits at 33% backend against an 80% floor

  testing
  Flatts3000/relay#6 · Filter by author Flatts3000 opened on Aug 28, 2026
  4

• No monitoring or alerting on production; the API outage went undetected

  blockedopspriority: high
  Flatts3000/relay#2 · Filter by author Flatts3000 opened on Aug 28, 2026
  4