Search results

No tests exist for the two pieces of real logic in the codebase

Status: Open.

#12 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

Version 0.1.0 is hardcoded in five places with nothing keeping them in sync

Status: Open.

#11 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

Code comments cite a design document that is gitignored and therefore unresolvable

Status: Open.

#10 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

Support address uses bolna.dev while every other reference uses bolna.ai

Status: Open.

#9 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

Privacy policy describes logging behavior that does not exist in the code

Status: Open.

#8 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

Upstream response shapes are asserted, never checked, producing misleading errors

Status: Open.

#7 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

connect.sh exposes the API key to other local users via the process list

Status: Open.

#6 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

Two timeout gaps: platform maxDuration is not configured, and upstream fetches have no deadline

Status: Open.

#5 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

A Supabase outage is indistinguishable from an invalid token, and userinfo is called on every request

Status: Open.

#4 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

Call transcripts are untrusted third-party text feeding money-spending tools

Status: Open.

#3 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

Supabase access tokens are accepted without audience validation

Status: Open.

#2 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026

# Environment-key fallback is a full auth bypass in production

Status: Open.

#1 In bolna-ai/mcp;

· rajarshidattapy opened on Jul 30, 2026