Production readiness #396

New issue

Copy link

New issue

Copy link

Open

Epic

67 / 8667 of 86 issues completed

Open

Production readiness#396

Epic

67 / 8667 of 86 issues completed

Copy link

Assignees

Milestone

202610

Description

aram356

opened on Mar 3, 2026

Issue body actions

No description provided.

Reactions are currently unavailable

Activity

Next

1. aram356

   added the

   Bug

   issue type on Mar 3, 2026
2. aram356

   changed the issue type from

   Bug

   to

   Epic

   on Mar 3, 2026
3. aram356

   added sub-issues on Mar 4, 2026

   • Audit unit test coverage: identify gaps and redundant tests #397
   • Integration tests: WordPress and Next.js frontends with Testcontainers #398
   • Request-signing store selection is inconsistent (hardcoded vs config-driven) #399
   • Admin endpoints unprotected unless handler regex covers them #400
   • Unsanitized creative HTML injected into iframe with weakened sandbox #401
   • Multiple global prototype patches stack without coordination #402
   • Panicking .expect() on regex compilation from user configuration #403
   • Only expose values in debug mode #404
   • Auction timeout config not enforced by orchestrator wait logic #405
   • Weak/inconsistent secret default validation #406
   • Regex-based HTML rewriting in document.write interception can fail-open #407
   • Configuration errors silently disable integrations #408
   • X-Forwarded-Host / Forwarded header spoofing enables URL rewrite hijack #409
4. 65 remaining items

   Load more
5. aram356

   added sub-issues on Jul 16, 2026

   • Make creative rewriting optional #914
   • Emit absolute URLs when rewriting creative resources #915
   • Design how to trace winning TS auction to corresponding creatives on the page #920
   • Add TS admin endpoint to look up EC by id #921
   • Add the Amazon APS Prebid Adapter as first class integration #764
6. prk-Jr

   added sub-issues on Jul 23, 2026

   • Streaming: HTML post-processor configs buffer the full document until origin EOF #924
   • Allowlist bid-level metadata in ts-debug auction dump #925
   • Pin and browser-test the GAM-served PUC render contract for inline SSAT creatives #926
   • expand_trusted_server_bidders leaks the zone key into every bidder's PBS params #927
   • For SSAT, make debug comment configurable #935
   • Prevent 304 responses for SSAT root documents #953
   • Investigate refresh too quickly after SSAT with client side auction (timing issue with GAM) #958
7. aram356

   added a sub-issue on Aug 1, 2026

   • CI lint gate misses JS test files and Node build scripts #985
8. aram356

   modified the milestones: v1, 202610 on Oct 1, 2026

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

• 
  ChristianPavilonis
• 
  aram356
• 
  prk-Jr

Labels

No labels

No labels

Type

Epic

Projects

No projects

Milestone

• 202610

Relationships

None yet

Development

No branches or pull requests

Issue actions

• Open in GitHub Copilot app