Exercise - list of issues

[bleskowsky]

FinancialAccountManager

• Logging sensitive information for debugging
• Printing stack traces directly (might leak depending on how it's called)
• Potential race conditions: no rollback if balance update fails midway. Dirty read updating incorrect balances

AccountDetails.tsx

• Backend validation that we are fetching only the authenticated user's settings

Loan.tsx

• Backend validation that we are fetching only the authenticated user's loans

Transactions.tsx

• Backend validation that we are fetching only the authenticated user's transactions

UserDetails.tsx

• Backend validation that we are fetching only the authenticated user's details
• Do we need to displaying taxID at all? Should we provide functionality to hide-reveal it.
• Don't render taxId directly in HTML

config.yaml

• Hardcoded keys
• Can we use IRSA instead?

dataSources.ts

• Pass relevant session data via authentication headers or body.

nextauth.ts

• Why is role being set through the client? This should come from the backend.