snapcart-api

src/middleware/error.ts:9

Unhandled exceptions bubble up raw stack traces and internal query shapes to the API client, leaking schema details and potentially sensitive values.

src/api/users.ts:42

User-controlled input is being interpolated directly into a SQL query string. An attacker who controls the query parameter could alter the query's logic and read, modify, or delete data they should not have access to.

src/api/profile.ts:18

The profile update handler trusts the request body without checking types, lengths, or allowed fields, so malformed or oversized payloads are processed as-is.

src/client/review.ts:31

Client review comments are injected into the DOM via innerHTML without sanitization, creating a stored XSS channel.

src/api/auth/callback.ts:64

The OAuth callback forwards users to a URL provided in the query string without host validation, allowing phishing links that start on a trusted domain.

src/api/webhooks/order.ts:87

The order webhook handler fires an async processing task without attaching a rejection handler, so failures drop silently into the void.

src/analytics/track.ts:12

eslint-disable blocks three warnings in the analytics script, including a no-unused-vars condition hiding what looks like a dead branch.

src/client/throttle.ts:21

External API calls are never given a timeout, so a hanging third-party service can pin Node workers indefinitely until they exhaust the process pool.

src/services/invoice.ts:41

Discount computation is copied across checkout and invoice modules and has already drifted by a rounding rule in one of them.

src/api/export.ts:55

The export endpoint reads every row matching a filter into memory in a single query, which grows without bound as sales data accumulates.

src/services/events.ts:57

A webhook whose first delivery fails is dropped, so downstream services can miss inventory and fulfillment events permanently.

src/services/payment.ts:73

The payment capture call is not wrapped in a try/catch and its failure is treated as success by the caller, so charge failures can silently mark orders as paid.

src/services/inventory.ts:102

A terse cast is used to silence a type mismatch, and the resulting any silently passes through three layers of the inventory service.

lib/config.ts:3

A development service account lives in a committed env fallback used when CI lacks real credentials.

src/services/retry.ts:8

A bare 30000 appears in the retry scheduler with no explanation of what it represents.

src/utils/format.ts:17

`formatSlug` is exported but never imported, so tree-shaking keeps it and its helper bundle.

src/admin/hero.tsx:44

Marketing images are rendered without alt text, failing non-text contrast and screen-reader guidance.