# Bug Tracking

No open bugs. All known issues have been fixed or accepted.

## Wontfix / Design Notes

### `_assert_safe_path` TOCTOU race
`spectra/web/server.py` — Path check and `send_file()` are not atomic. An attacker needs write access to the uploads dir to exploit. Mitigation would add complexity with negligible security gain.

### No cascade delete on Rotation FK
`spectra/web/models.py:31` — `Rotation.image_id` has no `ondelete="CASCADE"`. The single delete route handles cleanup explicitly. Add cascade if new deletion paths are added.

---

For a full history of fixes, see `git log`.