Issues

• [Medium] [Backend] [Maintainability] No single canonical MFA-bypass test user; duplicated & inconsistently-gated X-Dev-User dev auth

  zapp-startup/web-app#49 · Filter by author ashah-keystone opened on Jul 3, 2026
  2

• [High] [Frontend] [Logic] Reflection "complete the transaction" prompt re-opens on every return to /home after being dismissed (daily guard bypassed)

  zapp-startup/web-app#48 · Filter by author ashah-keystone opened on Jul 3, 2026

• [High] [Infrastructure/DevOps] [Build/Deploy] Backend CD workflow fails at startup — job-level 'if' uses the secrets context (validate + deploy never run)

  zapp-startup/web-app#46 · Filter by author ashah-keystone opened on Jul 2, 2026

• [High] [Backend] [Data Flow] AI chatbot ignores bank-synced transactions — spend insights undercount for Plaid-connected users

  zapp-startup/web-app#13 · Filter by author ashah-keystone opened on Jul 1, 2026

• [High] [Full-stack] [Data Flow] Bank transactions duplicated in transactions list after scoring/feedback (no dedup between manual mirror and bank source)

  zapp-startup/web-app#12 · Filter by author ashah-keystone opened on Jul 1, 2026

• [Low] [Frontend] [Build/Deploy] react/react-dom declared only as optional peerDependencies, not dependencies

  zapp-startup/web-app#11 · Filter by author ashah-keystone opened on Jul 1, 2026

• [Medium] [Backend] [Validation] Manual transaction feedback ratings not range-validated (inconsistent with bank feedback path)

  zapp-startup/web-app#10 · Filter by author ashah-keystone opened on Jul 1, 2026

• [Medium] [Backend] [Logic] Chatbot understates monthly subscription commitment — 'other' billing cycle normalized to $0

  zapp-startup/web-app#9 · Filter by author ashah-keystone opened on Jul 1, 2026

• [High] [Backend] [Security] Decrypted financial PII printed to stdout/logs on every value-score computation

  zapp-startup/web-app#8 · Filter by author ashah-keystone opened on Jul 1, 2026

• [High] [Backend] [Auth] Pending-MFA sessions can read/write profile, preferences & state data (IsAuthenticated instead of IsFullyAuthenticated)

  zapp-startup/web-app#7 · Filter by author ashah-keystone opened on Jul 1, 2026

• [Low] [Frontend] [Maintainability] Frontend package.json identity is leftover Figma Make template (@figma/my-make-file)

  zapp-startup/web-app#6 · Filter by author ashah-keystone opened on Jul 1, 2026

• [Medium] [Infrastructure/DevOps] [Build/Deploy] Production build leaks http://localhost:5173 into sitemap.xml/robots.txt when VITE_SITE_URL is unset

  zapp-startup/web-app#5 · Filter by author ashah-keystone opened on Jul 1, 2026
  1

• [Medium] [Frontend] [Failed Button] Search "Decision Engine" — Evaluate button and input are inert; results are hardcoded mock data

  zapp-startup/web-app#4 · Filter by author ashah-keystone opened on Jul 1, 2026

• [Medium] [Frontend] [SEO/Metadata] Canonical/OG URLs and contact email use wrong domain (zappai.com vs production zappai.co)

  zapp-startup/web-app#3 · Filter by author ashah-keystone opened on Jul 1, 2026

• [High] [Frontend] [Failed Button] Onboarding "Skip for now" loops back to /onboarding instead of skipping

  zapp-startup/web-app#2 · Filter by author ashah-keystone opened on Jul 1, 2026