{"uuid": "1af399f1-ea14-4fa5-822a-57dc2678793a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-31431", "type": "seen", "source": "https://gist.github.com/harsh-modelia/4325e84b4d8d9e2d8bbc2b79579978fd", "content": "# Bug Tracker \u2014 Harsh (`harsh-modelia`) \u00b7 2026-03-24 \u2192 2026-07-24\n\nAll bug-type issues raised and/or fixed across `modelia-ai/*` in the last 4 months.\n(Features, releases, docs and research tasks excluded.)\n\n## Summary\n\n| Metric | Count |\n|---|---|\n| Bugs raised by me | 36 |\n| Bugs reported by teammates, fixed by me | 16 |\n| **Total bug issues touched** | **52** |\n| Security bugs | 3 |\n| Still open | 1 (mvp#5111) |\n\nRepos: `shopify-app` (16) \u00b7 `website` (14) \u00b7 `customer-chat-agent` (13) \u00b7 `mvp` (9)\n\n---\n\n## \ud83d\udd10 Security (raised + fixed by me)\n\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| website#2579 / mvp#4589 | 2026-05-07 | 2026-05-14 | Client-supplied `creditsAmount` in `/api/create-or-update-plan` can be tampered to grant arbitrary credits |\n| mvp#4560 | 2026-05-04 | 2026-05-05 | Patch Linux kernel CVE-2026-31431 on Shopify app VPS |\n| shopify-app#181 | 2026-05-19 | 2026-05-19 | platform.modelia.ai indexed by Google \u2014 blocked crawlers via robots.txt |\n\n---\n\n## Bugs I raised (and fixed)\n\n### shopify-app\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| #234 | 2026-07-17 | 2026-07-17 | `scopes_update` webhook 500s under USE_UNIFIED_SESSIONS (raw prisma session write) |\n| #232 | 2026-07-17 | 2026-07-17 | Annual-downgrade deferral broken in unified mode (SQLite plan reads + dead StorePlan writes) |\n| #230 | 2026-07-17 | 2026-07-17 | Dockerfile not ACA-ready (PM2 daemonizes, broken fresh-DB boot, dev deps in prod image) |\n| #226 | 2026-07-07 | 2026-07-07 | Upload box: drag & drop doesn't work; dropped files should confirm via product modal |\n| #224 \ud83d\udc1b | 2026-07-03 | 2026-07-13 | Consistent-character image mode broken: face-preprocess bridge sends camelCase `imageBase64`, images-server expects `image_base64` |\n| #220 | 2026-07-02 | 2026-07-02 | External links (modelia.ai) open inside the embedded app instead of a new tab |\n| #218 \ud83d\udc1b | 2026-06-30 | 2026-07-13 | Consistent character ignored in model tools \u2014 engine returns a random model |\n| #206 | 2026-06-24 | 2026-06-24 | Upload modal won't reopen after first use |\n| #213 | 2026-06-24 | 2026-07-13 | Library cards are uneven (videos + long titles) |\n| #201 | 2026-06-23 | 2026-07-13 | Library/Home: clicking a project opens /app instead of the tool |\n| #199 \ud83d\udc1b | 2026-06-17 | 2026-06-17 | Enhance-prompt broken in unified mode (400 validation + missing sync) |\n| #195 \ud83d\udc1b | 2026-06-07 | 2026-06-18 | Bridge skips one-time (Project pack) purchase updates \u2014 credits not applied |\n| #177 | 2026-05-07 | 2026-05-07 | Missing upload icon and cursor affordance in UploadArea |\n\n### website\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| #3957 | 2026-07-16 | 2026-07-17 | Shopify sessions: `/sessions/store` rejects token invalidation (401 recovery breaks) |\n| #3821 \ud83d\udc1b | 2026-07-08 | 2026-07-13 | Shopify merchants never receive monthly subscription renewal credits |\n| #3798 | 2026-07-08 | 2026-07-13 | Multi-image tools double-generate and double-charge after refresh/project-reopen (duplicate input in `imageUrls`) |\n| #3726 \ud83d\udc1b | 2026-07-02 | 2026-07-03 | Project pack purchase from pricing page fails: \"No transition rule for starter -> project\" |\n| #3405 | 2026-06-12 | 2026-07-13 | MonumentExtended font 404s after #3395 \u2014 headings render in overlapping fallback |\n| #3300 | 2026-06-09 | 2026-06-09 | Multi-image inputs lost after reload/library-open (only first input persisted) |\n| #3286 \ud83d\udc1b | 2026-06-08 | 2026-06-18 | Auth page headings render ~1.9x oversized on SPA routes (missing MonumentExtended @font-face) |\n| #2709 | 2026-05-13 | 2026-07-08 | Subscription page shows bogus \"Next bill on\" date for project plans |\n\n### mvp\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| #5330 | 2026-07-21 | 2026-07-21 | Bump metadata `text_model` off deprecated gemini-2.5-flash |\n| #5111 | 2026-06-24 | **open** | Consistent characters created in Shopify app don't appear (read from wrong table) |\n| #4567 | 2026-05-05 | 2026-05-27 | AI Shorts Generator: 403 on Azure blob URLs when reopening projects from library |\n| #4478 | 2026-04-18 | 2026-06-26 | Modelia logo broken in chatbot |\n| #4465 | 2026-04-16 | 2026-04-21 | VTON not supporting model photo from Model Generator in Modelia workflows |\n\n### customer-chat-agent\n| Issue | Opened | Closed | Title |\n|---|---|---|---|\n| #74 | 2026-07-21 | 2026-07-21 | Reports: count archived conversations in \"conversations started\" |\n| #73 | 2026-07-21 | 2026-07-21 | Resolver: match agents by forwarder address (fixes dropped web-form leads) |\n| #71 | 2026-07-21 | 2026-07-21 | Contact forms: extract submitter's email from the HTML part |\n| #70 | 2026-07-21 | 2026-07-21 | Anti-loop: exempt our own forwarder groups (contact@/support@) from bulk/list checks |\n| #69 | 2026-07-21 | 2026-07-21 | Deploy-safe boot migrations: per-statement lock_timeout + retry (**prod outage fix**) |\n| #66 | 2026-07-21 | 2026-07-21 | Live Chat: send AI replies as one humanized message (no bubbles) |\n| #65 | 2026-07-21 | 2026-07-21 | Sophie: behavior + knowledge fixes from Jose's audit |\n| #47 | 2026-07-14 | 2026-07-14 | Emma email agent: restore mailbox access, stop losing forwarded mail, spam filter + chat-style escalation |\n\n---\n\n## Bugs reported by teammates, fixed by me\n\n| Issue | Reporter | Opened | Closed | Title |\n|---|---|---|---|---|\n| website#3526 | vaishak-lgtm | 2026-06-23 | 2026-07-24 | Shopify-bridge install bypasses the one-trial-per-email ledger (re-install farms starter credits) |\n| mvp#5213 | josebrujo | 2026-07-07 | 2026-07-22 | Logged-in user's email not showing in live chat (Chrome 148, macOS) |\n| mvp#5212 | josebrujo | 2026-07-07 | 2026-07-13 | AI Video: chatbot gives incorrect info about backgrounds |\n| mvp#5211 | josebrujo | 2026-07-06 | 2026-07-13 | Download image button didn't work successfully |\n| mvp#5209 | josebrujo | 2026-07-06 | 2026-07-13 | Chatbot gave incorrect video pricing |\n| website#3866 | gurpreet-modelia | 2026-07-09 | 2026-07-13 | Empty consistent-character husk rows count toward the plan cap and are invisible in the UI |\n| website#3669 | ivan-modelia | 2026-06-30 | 2026-07-01 | Live Chat: AI mixes messages from current and previous conversations |\n| website#3634 | josebrujo | 2026-06-29 | 2026-07-01 | Text+image in same message: text not showing up |\n| customer-chat-agent#11 | ivan-modelia | 2026-06-29 | 2026-07-01 | Live Chat: image preview opens a blank page |\n| customer-chat-agent#12 | ivan-modelia | 2026-06-29 | 2026-07-01 | Live Chat: in-chat images have no download button |\n| customer-chat-agent#13 | ivan-modelia | 2026-06-29 | 2026-07-01 | Live Chat: links sent in chat are not clickable (plain text) |\n| customer-chat-agent#14 | ivan-modelia | 2026-06-29 | 2026-07-01 | Live Chat: operator messages cannot be deleted right after being sent |\n| website#2336 | ivan-modelia | 2026-04-20 | 2026-05-27 | Invalid querySelector `#` causing mass JavaScript errors (60.81% of all JS errors) |\n| mvp#4477 | ivan-modelia | 2026-04-18 | 2026-04-20 | Outfit generator not working properly (user report) |\n| website#2008 | sidhanth-modelia | 2026-03-24 | 2026-04-06 | Workflows: AI Fashion Lab node doesn't support Model Selector connection |\n| mvp#4350 | josebrujo | 2026-04-01 | 2026-04-03 | Modelia Workflows not working properly |\n\n---\n\n*Generated 2026-07-24 from GitHub search across `modelia-ai/*` (issues authored by / assigned to `harsh-modelia`, window 2026-03-24 \u2192 2026-07-24). \ud83d\udc1b = carried the `bug` label; unlabeled items classified by title/content.*\n", "creation_timestamp": "2026-07-24T09:11:11.192790Z"}