Issues

• Product pages have no real SEO: static title, no server-rendered data, no sitemap entries, no Product JSON-LD

  enhancementjavascript
  OffCrazyFreak/Disscount#230 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Show the unexpected-failure error in Settings > Sigurnost instead of failing silently

  accessibilitybug
  OffCrazyFreak/Disscount#227 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Map entity-level Bean Validation failures to a 400 problem detail and move their messages to codes

  bugjavatech-debt
  OffCrazyFreak/Disscount#226 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Format price history chart tooltip values as euro amounts with two decimals

  bugjavascript
  OffCrazyFreak/Disscount#225 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Move iOS splash link tags into the root metadata (appleWebApp.startupImage)

  tech-debt
  OffCrazyFreak/Disscount#224 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Add an advisory password strength meter with a live breach warning to the new-password fields

  accessibilitydependenciesenhancementsecurity
  OffCrazyFreak/Disscount#223 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Move watchlist alerts to a server-side notification inbox with read state, shared by in-app, push and email

  accessibilityenhancementjavajavascript
  OffCrazyFreak/Disscount#222 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Deliver watchlist price alerts as Web Push notifications

  accessibilityenhancementjavajavascript
  OffCrazyFreak/Disscount#221 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Offer optional two-factor authentication (TOTP with backup codes) and passkeys

  accessibilitydependenciesenhancementsecurity
  OffCrazyFreak/Disscount#220 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Show active sessions per device in Settings > Sigurnost with per-device sign-out

  accessibilityenhancementsecurity
  OffCrazyFreak/Disscount#219 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Add a personal data export to settings (GDPR Art. 15 access and Art. 20 portability): one re-authenticated JSON download

  accessibilitydocumentationenhancementjavajavascriptsecurity
  OffCrazyFreak/Disscount#218 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Bring the privacy policy, analytics and Replay consent, and recorded terms acceptance up to GDPR standard

  documentationenhancementjavascriptsecurity
  OffCrazyFreak/Disscount#217 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Fix pre-set notification consent and build a compliant email price alert and newsletter path

  enhancementjavajavascriptsecurity
  OffCrazyFreak/Disscount#216 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Add Cloudflare Turnstile bot protection to sign-up, sign-in, forgot password and the contact form, and harden the honeypot

  enhancementjavajavascriptsecurity
  OffCrazyFreak/Disscount#215 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Harden admin access: replace the first-signup-becomes-admin bootstrap, enforce admin on every request with method security, add last-admin and self-change guards, and minimise the admin user list

  enhancementjavajavascriptsecuritytech-debt
  OffCrazyFreak/Disscount#214 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Harden the Spring backend and HTTP headers: docs exposure, contact auth, Facebook server-side, missing headers

  javajavascriptsecuritytech-debt
  OffCrazyFreak/Disscount#213 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Keep reset and verification tokens out of Sentry events, Replay and server logs

  enhancementsecurity
  OffCrazyFreak/Disscount#212 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Add a security audit log for sign-in, account changes and admin actions, with a defined event vocabulary and retention

  documentationenhancementjavajavascriptsecurity
  OffCrazyFreak/Disscount#211 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Send security notification emails for password, email, sign-in method and account changes

  enhancementsecurity
  OffCrazyFreak/Disscount#210 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Refuse sign-in with a correct but breached password and email a 30-minute reset link

  accessibilityenhancementsecurity
  OffCrazyFreak/Disscount#209 · Filter by author OffCrazyFreak opened on Oct 12, 2026
  1

• Reject breached passwords (Pwned Passwords) on sign-up, reset, change-password and set-password

  enhancementsecurity
  OffCrazyFreak/Disscount#208 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Require recent authentication before account deletion, email change, password set and account unlink

  accessibilityenhancementsecurity
  OffCrazyFreak/Disscount#207 · Filter by author OffCrazyFreak opened on Oct 12, 2026
  1

• Fix rate limiting behind Cloudflare and Traefik and cover the custom account routes and the contact form

  enhancementjavajavascriptsecurity
  OffCrazyFreak/Disscount#206 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Close the timing gap in the register route and replace the existing-email password reset with a throttled "account exists" notice

  enhancementsecurity
  OffCrazyFreak/Disscount#205 · Filter by author OffCrazyFreak opened on Oct 12, 2026

• Replace password composition rules with one length-based policy enforced on the server for every endpoint

  enhancementsecurity
  OffCrazyFreak/Disscount#204 · Filter by author OffCrazyFreak opened on Oct 12, 2026