Issues

• [Bug]: Missing ownership check in POST /orders/{id}/payments allows acting on another user's order

  bug
  worknenjoy/gitpay#1627 · Filter by author a1woareS opened on Oct 26, 2026
  1

• [Bug]: Unverified userId query parameter in /callback/github/private allows creating tasks under arbitrary user accounts

  bug
  worknenjoy/gitpay#1626 · Filter by author a1woareS opened on Oct 26, 2026
  1

• [Bug]: IDOR in order and wallet-order read endpoints exposes other users' payment metadata and invoices

  bug
  worknenjoy/gitpay#1625 · Filter by author a1woareS opened on Oct 26, 2026
  1

• [Bug]: Unauthenticated email relay on task invite/funding/report

  bug
  worknenjoy/gitpay#1624 · Filter by author a1woareS opened on Oct 26, 2026
  1

• [Bug]: Missing ownership check in PUT /tasks/{id}/assignment/remove allows any authenticated user to unassign any task

  bug
  worknenjoy/gitpay#1623 · Filter by author a1woareS opened on Oct 26, 2026
  2

• [Bug]: IDOR in PUT /wallets/{id} allows any authenticated user to modify another user's wallet

  bug
  worknenjoy/gitpay#1622 · Filter by author a1woareS opened on Oct 26, 2026
  1

• [Bug]: Missing authorization and mass assignment in payment-request transfer endpoints allow tampering with any settlement record

  bug
  worknenjoy/gitpay#1621 · Filter by author a1woareS opened on Oct 26, 2026
  3

• [Bug]: Broken object-level authorization in PUT /payment-requests/{id} allows any authenticated user to take over another user's payment request

  bug
  worknenjoy/gitpay#1615 · Filter by author a1woareS opened on Oct 26, 2026
  3

• [Bug]: IDOR in GET /tasks/delete/{taskId}/{userId} allows any authenticated user to delete another user's task

  bug
  worknenjoy/gitpay#1614 · Filter by author a1woareS opened on Oct 26, 2026
  3

• [Bug]: IDOR in wallet-funded order creation (POST /orders) allows any authenticated user to spend another user's wallet balance

  bug
  worknenjoy/gitpay#1613 · Filter by author a1woareS opened on Oct 26, 2026
  3

• [Bug]: Mass assignment in PUT /wallets/orders/{id} allows any authenticated user to credit a wallet without paying

  bug
  worknenjoy/gitpay#1612 · Filter by author a1woareS opened on Oct 26, 2026
  7

• [Bug]: Broken access control in POST /tasks/payments allows any authenticated user to create an arbitrary Stripe transfer

  bug
  worknenjoy/gitpay#1611 · Filter by author a1woareS opened on Oct 26, 2026
  3

• [Bug]: Organization task sorting is ignored before pagination

  worknenjoy/gitpay#1599 · Filter by author EazyHood opened on Oct 9, 2026

• Contributor “Make an offer” can fail because taskUpdate requires task ownership before processing Offer

  worknenjoy/gitpay#1572 · Filter by author ranzevor opened on Sep 13, 2026
  4

• Design an agnostic issue-import & claim-verification architecture (GitLab, Codeberg, KDE Bugzilla, Bitbucket)

  worknenjoy/gitpay#1563 · Filter by author alexanmtz opened on Sep 8, 2026
  6

• [Bug]: deleteTask throws on network failures and leaves task pending

  worknenjoy/gitpay#1561 · Filter by author Rototypech opened on Sep 8, 2026
  3

  

• Claim-request action rejects successful mail-provider responses

  worknenjoy/gitpay#1557 · Filter by author pkanchi23 opened on Sep 7, 2026
  1

• [Feature] [Refactor] Better handling of Status update for payments

  enhancementfeatureFullstackmediumnode.jsODHack14reactrefactoring
  Feature

  worknenjoy/gitpay#1200 · Filter by author alexanmtz opened on May 27, 2025 · v2.0
  8

• Support for codeberg.org

  worknenjoy/gitpay#1150 · Filter by author cweiske opened on Nov 13, 2024
  3

• Support for bugs.kde.org

  worknenjoy/gitpay#1098 · Filter by author Zahrun opened on May 4, 2024
  4

• Support for GitLab

  worknenjoy/gitpay#1097 · Filter by author Zahrun opened on May 4, 2024
  7

• A model for teams

  enhancementhiringnode.jsstarter
  worknenjoy/gitpay#547 · Filter by author alexanmtz opened on Mar 23, 2020 · v2.0
  9

  

• Update readme

  first-timers-only
  worknenjoy/gitpay#247 · Filter by author first-timers opened on Jan 2, 2019
  101