Issues

• [Optimization][Low] Minor cleanups found during review (CLI, Worker, browser)

  YashasVM/cd#51 · Filter by author YashasVM opened on Oct 14, 2026

• [Bug][Low] A code claimed while the sender disconnects is orphaned: it resolves to a dead room for 15 min and is never released

  YashasVM/cd#50 · Filter by author YashasVM opened on Oct 14, 2026

• [Bug][Low] Staged OPFS files (cd-rx-*) are never swept and leak browser storage after crashes or killed tabs

  YashasVM/cd#49 · Filter by author YashasVM opened on Oct 14, 2026

• [Security][Low] Out-of-order record buffers let a peer pin about 256 MiB of receiver memory, bypassing the 32 MiB pending cap

  YashasVM/cd#48 · Filter by author YashasVM opened on Oct 14, 2026

• [Security][Low] Transfer rooms reset to empty 5 min after finishing, so anyone holding an old link can re-host it and impersonate the sender

  YashasVM/cd#47 · Filter by author YashasVM opened on Oct 14, 2026

• [Bug][Medium] Opening a share link takes the one-time receiver slot on page load, so link scanners and prefetchers burn transfers

  YashasVM/cd#46 · Filter by author YashasVM opened on Oct 14, 2026

• [Bug][Medium] cdx receive staging files are opened with O_TRUNC and no O_EXCL; bundle staging uses one fixed name per folder

  YashasVM/cd#45 · Filter by author YashasVM opened on Oct 14, 2026

• [Bug][Medium] cdx receive bundle unpack silently overwrites files without --force (case-insensitive name collisions and pre-existing .cd-part files)

  YashasVM/cd#44 · Filter by author YashasVM opened on Oct 14, 2026

• [Security][High] cdx receive unpacks Deflate bundle entries with no size cap (zip bomb fills the receiver's disk)

  YashasVM/cd#43 · Filter by author YashasVM opened on Oct 14, 2026

• [Security][Medium] Share-code directory can be exhausted by unauthenticated, cross-site POST /api/codes, which stops every code-mode send

  YashasVM/cd#42 · Filter by author YashasVM opened on Oct 14, 2026

• [Security][High] Short-code brute force: the per-IP limit is keyed on the full IPv6 address and failed lookups never burn a code

  YashasVM/cd#41 · Filter by author YashasVM opened on Oct 14, 2026

• Browser multi-file downloads can produce duplicate flattened filenames

  YashasVM/cd#40 · Filter by author YashasVM opened on Oct 13, 2026

• Verify free-service and release prerequisites

  wayfinder:grilling
  YashasVM/cd#16 · Filter by author YashasVM opened on Sep 17, 2026

• Choose background reception guarantees

  wayfinder:grilling
  YashasVM/cd#14 · Filter by author YashasVM opened on Sep 17, 2026

• CD highway: trusted, resumable Android and Linux transfers

  wayfinder:map
  YashasVM/cd#9 · Filter by author YashasVM opened on Sep 17, 2026
  2