spectra/bug-tracking.md

Bug Tracking

No open bugs. All known issues have been fixed or accepted.

Wontfix / Design Notes

_assert_safe_path TOCTOU race

spectra/web/server.py — Path check and send_file() are not atomic. An attacker needs write access to the uploads dir to exploit. Mitigation would add complexity with negligible security gain.

No cascade delete on Rotation FK

spectra/web/models.py:31 — Rotation.image_id has no ondelete="CASCADE". The single delete route handles cleanup explicitly. Add cascade if new deletion paths are added.

---

For a full history of fixes, see git log.