Issues

• fix(auth): nonce issuance is split across three diverged implementations; nonces are never consumed and the live store never evicts

  area:authbugdifficulty:hardfrontendStellar Wave
  Remitwise-Org/Remitwise-Frontend#1751 · Filter by author Baskarayelu opened on Oct 18, 2026
  4

  

• security(bills): Idempotency-Key ledger is global across users, so a guessed key replays another user's bill

  area:billsdifficulty:mediumfrontendsecurity
  Remitwise-Org/Remitwise-Frontend#1750 · Filter by author Baskarayelu opened on Oct 18, 2026
  2

  

• security(admin): admin guard for /api/cache/invalidate must be header-only, constant-time and fail closed

  area:admindifficulty:mediumfrontendsecurityStellar Wave
  Remitwise-Org/Remitwise-Frontend#1746 · Filter by author Baskarayelu opened on Oct 18, 2026
  5

  

• fix(auth): migrateSession never upgrades explicit v1/v0 sessions, passes through future versions and labels invalid data as V2

  area:authbugdifficulty:mediumfrontendStellar Wave
  Remitwise-Org/Remitwise-Frontend#1745 · Filter by author Baskarayelu opened on Oct 18, 2026
  2

  

• fix(webhooks): lease expiry re-runs handlers that are still executing, and crash-looping events never reach the DLQ

  area:webhooksbugdifficulty:hardfrontendStellar Wave
  Remitwise-Org/Remitwise-Frontend#1737 · Filter by author Baskarayelu opened on Oct 18, 2026
  3

  

• security(auth): auth_token cookie is trusted without signature verification, so any principal can be impersonated

  area:authdifficulty:hardfrontendsecurityStellar Wave
  Remitwise-Org/Remitwise-Frontend#1736 · Filter by author Baskarayelu opened on Oct 18, 2026
  3