Bug Dashboard | Notion

Summary of all registered findings. Full evidence and root-cause detail: repo docs/bug-audit.md.

🔴 Open — active (1)

BUG-026 · Critical · Production GET /api/hero returns 500 — HeroContent.resumePreviewUrl column missing from the prod Supabase DB (schema drift; the deploy's db push never applied it). Admin → Settings can't load on the live site; /resume preview field broken. Fix: additive ALTER TABLE "HeroContent" ADD COLUMN IF NOT EXISTS "resumePreviewUrl" TEXT NOT NULL DEFAULT '' in the Supabase SQL editor (not db push, per §3.3). Backend GET handler hardened to log the real cause. Detail: repo docs/debug/hero-api-500.md (KI-10 / TD-07).

Resolved (16)

ID	Sev	Title	Area
BUG-001	High	Admin sidebar recreated every render (state loss)	Admin UI
BUG-003	Med	Footer raw `<a>` for internal nav	Navigation
BUG-004	Low	Unescaped quotes in JSX	Admin UI
BUG-005	Med	jsx-a11y false positive (lucide `Image` icon) — import aliased	A11y
BUG-007	Low	Unused imports/vars	Dead code
BUG-008	High	Frontend dep vulns (postcss XSS via next) — next → 16.2.10	Security
BUG-009	High	Backend dep vulns (qs DoS etc.) — audit fix applied	Security
BUG-010	Critical	API fallback port mismatch (5000 vs 5001) broke admin CRUD in default dev	API contract
BUG-011	High	No rate limiting on /auth/login + /auth/setup	Security
BUG-012	High	/auth/setup accepted missing/weak credentials	Security
BUG-013	High	No global error handler / env fail-fast in backend	Error handling
BUG-014	Low	Contact form timer leak	Memory
BUG-015	High	Admin dashboard swallowed API errors silently	Admin UX
BUG-016	High	No 401 auto-logout for expired admin sessions	Auth
BUG-018	Med	Missing 404 / 500 / loading pages	Error states
A11Y-001/003/006	Med	Reduced-motion support, icon button labels, form status live region	A11y

Closed as false positives (2)

BUG-017 — HomePageClient refetch effect (cleanup exists; deliberate cold-start recovery)
"Express 5 doesn't catch async errors" (subagent claim) — corrected; real gap was the missing error middleware (fixed as BUG-013)

Open — accepted with plans (8 known issues, 10 debt items)

See Technical Debt & Future Improvements child page. Highest-value open items: image optimization (next/image migration), contrast verification, Zod validation on admin CRUD.