Issues

• feat(core): per-route rate limits and a production warning for the in-memory limiter

  area:coreenhancementsecurity
  thexjs/x#280 · Filter by author abdelkabirouadoukou opened on Oct 10, 2026

• fix(core): Redis rate-limit store INCR/EXPIRE is not atomic (key can lose its TTL)

  area:corebugsecurity
  thexjs/x#279 · Filter by author abdelkabirouadoukou opened on Oct 10, 2026
  1

• feat(core): per-page title and meta tags

  area:coreenhancement
  thexjs/x#278 · Filter by author abdelkabirouadoukou opened on Oct 10, 2026

• feat(core): make exposed server actions explicit (every export is a public endpoint)

  area:coredocumentationenhancementsecurity
  thexjs/x#277 · Filter by author abdelkabirouadoukou opened on Oct 10, 2026

• feat(core): schema validation for server action inputs

  area:coreenhancementhelp wantedsecurity
  thexjs/x#276 · Filter by author abdelkabirouadoukou opened on Oct 10, 2026

• [auth] AuthGuardResult breaking type change shipped as patch, should be minor

  area:authbug
  thexjs/x#240 · Filter by author abdelkabirouadoukou opened on Aug 27, 2026

• [core][auth] trusted-proxy default silently disables IP-based brute-force/rate-limit protection for non-Vercel deployments

  area:autharea:corebugsecurity
  thexjs/x#238 · Filter by author abdelkabirouadoukou opened on Aug 27, 2026

• [create-thexjs-app] Addon runtime deps unmanaged — undocumented zero-dep claim

  area:clidocumentationgood first issuehelp wanted
  thexjs/x#191 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [create-thexjs-app] TOCTOU check-then-create on target dir

  area:clibughelp wanted
  thexjs/x#189 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [create-thexjs-app] No rollback on partial scaffold failure

  area:clibughelp wanted
  thexjs/x#188 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [create-thexjs-app] No package-manager detection — always shells literal 'bun'

  area:clienhancementhelp wanted
  thexjs/x#187 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [cli][core] SSE live-reload never reconnects after server restart

  area:cliarea:corebughelp wanted
  thexjs/x#183 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [cli] No top-level error boundary around main()

  area:clibughelp wanted
  thexjs/x#181 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [env] oneOf validator unsafe cast undocumented

  area:envdocumentationgood first issuehelp wanted
  thexjs/x#178 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [auth] authorizationParams can override state/code_challenge

  area:authbughelp wantedsecurity
  thexjs/x#174 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [adapter-vercel] forwarded proto/host not origin-authenticated — CSRF self

  area:authbughelp wantedsecurity
  thexjs/x#173 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [env] createEnv returns flat object — no client/server boundary

  area:envenhancementhelp wanted
  thexjs/x#172 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• [auth] node:crypto + TCP session stores block Edge Function usage

  area:authenhancementhelp wanted
  thexjs/x#171 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• Low: catch-all route segment is an unbounded greedy group

  area:coreenhancementhelp wanted
  thexjs/x#165 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• Low: snapshotActionRoutes deep-clones the registry on every server-function call

  area:coreenhancementhelp wanted
  thexjs/x#164 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• Medium: ISR cache replays a single CSP nonce for the whole revalidation window

  area:corehelp wantedsecurity
  thexjs/x#163 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• Medium: client-nav has no generation guard - fast navigations can race and render stale content

  area:corebughelp wanted
  thexjs/x#162 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• High: routing recompiles a RegExp per route per request

  area:coreenhancementhelp wanted
  thexjs/x#161 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• P3: auth scaffold login/logout templates have no CSRF check

  area:clibughelp wantedsecurity
  thexjs/x#157 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026

• P2: islandEntryId hash is 32-bit and can collide at scale

  area:coreenhancementhelp wanted
  thexjs/x#156 · Filter by author abdelkabirouadoukou opened on Aug 20, 2026