Issues

• [Tracking] Push notification follow-ups after #417

  enhancementMobile
  Task

  docs-plus/docs.plus#447 · Filter by author HMarzban opened on Oct 6, 2026

• Remove dead code left after the security fixes

  Refactor
  Task

  docs-plus/docs.plus#446 · by Filter by author HMarzban was closed on Oct 9, 2026
  1

• Give the observability containers least privilege

  DevOpsSecurity
  Task

  docs-plus/docs.plus#443 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06
  1

• Confirm the password-token hook is on, and correct the connected-app docs

  AuthSecurity
  Task

  docs-plus/docs.plus#441 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06
  2

• Require approval before fork pull requests run workflows

  CriticalDevOpsSecurity
  Task

  docs-plus/docs.plus#440 · by Filter by author HMarzban was closed on Oct 9, 2026 · Security review 2026-10-06
  1

• Require a password on production Redis

  DevOpsSecurity
  Task

  docs-plus/docs.plus#438 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06
  1

• Run only reviewed main-branch workflows on the production runner

  DevOpsSecurity
  Task

  docs-plus/docs.plus#437 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06
  1

• Email 7/7 (Ops B): Supabase Auth magic links through Resend SMTP

  enhancement
  Task

  docs-plus/docs.plus#425 · by Filter by author HMarzban was closed on Oct 12, 2026
  2

  

• Email 6/7 (Ops A): production product mail cutover to Resend

  enhancement
  Task

  docs-plus/docs.plus#424 · Filter by author HMarzban opened on Oct 6, 2026
  2

  

• Email 5/7 (PR 4): admin Email setup page with a test email

  enhancement
  Task

  docs-plus/docs.plus#423 · by Filter by author HMarzban was closed on Oct 9, 2026
  1

• Email 4/7 (PR 3): Resend webhook for bounces and complaints

  enhancement
  Task

  docs-plus/docs.plus#422 · by Filter by author HMarzban was closed on Oct 9, 2026
  1

• Email 3/7 (PR 2): typed failures, delivery and a safe DLQ drain

  enhancementRefactor
  Task

  docs-plus/docs.plus#421 · by Filter by author HMarzban was closed on Oct 9, 2026
  1

• Email 2/7 (Ops 0): Resend teams, domains, records and staging credentials

  enhancement
  Task

  docs-plus/docs.plus#420 · Filter by author HMarzban opened on Oct 6, 2026
  2

  

• Email 1/7 (PR 1): explicit provider config, the provider contract and job identity

  enhancementRefactor
  Task

  docs-plus/docs.plus#419 · Filter by author HMarzban opened on Oct 6, 2026
  2

• Tracking: move email to Resend behind a pluggable provider

  enhancement
  Task

  docs-plus/docs.plus#418 · Filter by author HMarzban opened on Oct 6, 2026
  4

  

• [Tracking] Security review 2026-10-06 fixes

  Security
  Task

  docs-plus/docs.plus#416 · Filter by author HMarzban opened on Oct 6, 2026 · Security review 2026-10-06
  2

• Bind dev and local Postgres, Redis and app ports to loopback only

  DevOpsSecurity
  Task

  docs-plus/docs.plus#414 · by Filter by author HMarzban was closed on Oct 9, 2026 · Security review 2026-10-06
  1

• Record the actor of every admin write action

  DevOpsenhancementSecurity
  Task

  docs-plus/docs.plus#404 · by Filter by author HMarzban was closed on Oct 9, 2026 · Security review 2026-10-06
  1

• Keep server secrets out of the webapp and admin-dashboard containers

  DevOpsSecurity
  Task

  docs-plus/docs.plus#403 · by Filter by author HMarzban was closed on Oct 12, 2026 · Security review 2026-10-06
  3

• Carry the production function revokes in the Supabase migrations

  DevOpsSecurity
  Task

  docs-plus/docs.plus#397 · by Filter by author HMarzban was closed on Oct 9, 2026 · Security review 2026-10-06
  3