Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Declare the object-storage secret the ConfigMap no longer carries
The MinIO key was moved out of the ConfigMap into the minio-app-credentials secret, but the envFrom that supplies it was only ever applied to the live deploymen...
Never let the quota service stop a service from starting
StorageQuotaService took its five repositories as required constructor arguments. Services in this estate component-scan com.kamo with a wildcard but declare an...
Stop shipping the shared credential in this repo
The object-storage key sat in k8s/configmap.yaml, which kubectl will hand to anyone who can read the namespace, and the same string was hardcoded as the SSH pas...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping a shared credential as a config default
The platform's shared password was baked in as the fallback for DB_PASSWORD and MINIO_ROOT_PASSWORD, so it lived in this repo and in the built image as well as ...
Stop shipping the shared credential in this repo
The mail MySQL password sat in plaintext across fourteen files here — in ConfigMaps that kubectl will hand to anyone who can read them, in two Jobs that CI appl...
Stop shipping the shared credential in this repo
The mail MySQL password sat in plaintext across fourteen files here — in ConfigMaps that kubectl will hand to anyone who can read them, in two Jobs that CI appl...
Stop revoking a member's billing access when adding them elsewhere
add() deleted the member's row on any other account to satisfy a global unique that no longer exists. Adding someone to a second billing account now leaves the ...
Assigning by hand must not consume the PRE_TICKET status
assignToAgent and reassignAgent set ASSIGNED unconditionally, which quietly made a chat request impossible to convert afterwards — convertPreTicket accepts noth...
Let a sub-org reach the account that pays for it
AccountSubscription deliberately separates the payer from the organization whose members consume the seats, and auto-provisioned accounts sit on the top-level K...
Derive the add-on unit from the catalog, and correct stale prices
The storage add-on advertised as "+$4 /user/month" for a pool the same page called organization-wide. Cause: mapAddOns matched addonCode "additional_storage" wh...
Charge what the catalog says, once, for the right quantity
Five defects that all moved real money, plus the sub-resource IDOR beneath them. Billing cycles. ANNUAL prices were sent to Stripe at the stored per-month rate...
Validate who a ticket may be handed to by hand
assignToAgent and reassignAgent checked only that the id resolved to a member. Assignment adds that member to the ticket's chat session, so an id from another o...
Verify god mode against the database, not a forged header
AccountOrgScopeInterceptor short-circuited every org and member check on the raw X-God-Mode-Active header, and kamo-internal's billing proxy copies that header ...
Auto Assignment offers the ticket, it does not allocate it
Auto Assignment pages every available support agent and goes to the first one who accepts. It was implemented as "silently pick the least-busy agent who is onli...
Run the topic's strategy for widget chats too
A chat opened in the web widget is the same unit of work as one filed inside the app, but this path skipped the topic's assignment strategy entirely — the only ...
Decide the sign-in auto-open on the server, not in this tab
The per-tab sessionStorage flag was not a record of anything. Signing in on a second device replayed every conversation the first had already popped, and cleari...
Don't let one failed request silence the sign-in auto-open
Unread chats are auto-opened once per tab-session, guarded by a sessionStorage flag. That flag was written up-front, before the fetch that tells a chat session ...
Stop typing an unseen support session as a plain chat
A live activity frame for a session not already in the list synthesized a row hard-coded to 'CHAT'. For a support ticket that put it in the wrong sub-tab, showe...
Put the session type on the activity frame too
The unread/ACTIVITY broadcast is published for every session type and carried no indication of which. The chats list, having nothing to go on, typed an unseen s...
Stop a support ticket opening a plain chat window full of JSON
Two faults, one symptom. Assignment makes the agent a member of the ticket's media session, so the incoming-message notification reached them and ChatNotificati...
Tell the client which kind of conversation a message arrived in
Every member of a media session receives the incoming-message notification, and assigning a support ticket makes the agent a member of that ticket's session. Th...
Declare the calendar tokens at :root, and rebuild the event dialog
The tokens were declared on the calendar wrapper element, which reads as the tidy thing to do and is wrong. MUI dialogs and menus render through a portal into d...
Actually override the operator label ink
The previous attempt raised specificity, which was the wrong diagnosis: tailwind.config.js sets `important: true`, so every declaration in .operator-label ships...
Widen the support topic assignment_strategy range CHECK to 0..3
SupportAssignmentStrategyType is @Enumerated(ORDINAL), so Hibernate emitted CHECK (assignment_strategy >= 0 AND assignment_strategy <= 2) on CREATE TABLE rather...
Make every line of the hero readable
The kicker and the three readout labels were painted by .operator-label's own dark ink, not by the colour set beside it: a class and an sx rule carry the same s...
Make the pinned-app eyebrow actually white
The previous attempt overrode .operator-label's ink with a class-qualified sx rule, which could never have worked: tailwind.config.js sets `important: true`, so...
Return the account's creation date to the account list
buildAccountSummary never emitted dateCreated, so the field the list's Date Created column reads was simply absent from the response. Now that Account records t...
A live chat is claimed through the popup, never allocated
Routing chat requests through round-robin was the wrong model and it broke the thing it was meant to fix. An assigned ticket leaves the claimable queue (Support...
Take the caller from the session, not from the query string
GET /api/calendar/calendars took userId as a request parameter, so changing a number in the URL read anyone's calendars — and because calendars carried no organ...
Stop assignment failures destroying the ticket that triggered them
Routing a new ticket ran inside the creation transaction, so anything it hit rolled the ticket back with it and the member asking for help got "Failed to create...
Give each account tab the default order it should open in
The three tabs opened in whatever order the API happened to return, which for members meant the newest sign-ups were buried and for team members meant no order ...
Stop BUSY surviving every future login
Logout writes AWAY and login clears it, so AWAY is a state the system puts you in and takes you out of. Nothing ever cleared BUSY. A member who set it once stay...
Route a chat request through the topic's assignment strategy
A support chat request is filed as a PRE_TICKET, and createTicket skipped assignment for those outright. The guard was written for the web-chat widget, where a ...
SecurityService pool exhaustion caused liveness kills
Hikari had no explicit maximum-pool-size, so it ran on the default of 10 while fronting org/rights lookups for every service and the internal site. Observed tot...
Scope the default-lead-source readiness banner to Residential Mortgage markets
The vendors/products tab showed the "Finish the mortgage vertical to designate a default lead source" warning on every market tab, including Product/Service and...
Centre the selection bar on the contact list, not the page
The bar that appears when rows are selected is absolutely positioned at left 50% with a translateX(-50%), but its nearest positioned ancestor was the whole page...
Make MKCOL create a book that can actually be stored
mkCol built a ContactBook carrying neither an organisation nor an owner and returned 201 regardless, so creating an address book from a CardDAV client failed at...
Like what you see shipping?
All of it arrives in your workspace on its own. Start on the free plan and read this page again in a month.