Issues

• fix(deps): adopt reviewed cloud-commitments-go purchase safeguards

  effort/mimpact/fewpriority/p2severity/mediumtriagedtype/bugurgency/this-sprint
  LeanerCloud/cloud-commitments-platform#452 · Filter by author cristim opened on Sep 29, 2026

• fix(api): marketplace listing should reject expired RIs and return 4xx (not 500) for bad timestamps/terms

  effort/xspriority/p2severity/mediumtype/bug
  LeanerCloud/cloud-commitments-platform#449 · Filter by author cristim opened on Sep 28, 2026

• fix(api): Azure revoke quote endpoint returns 0/"" when Azure omits the refund amount (misleading dialog)

  effort/xspriority/p3type/bug
  LeanerCloud/cloud-commitments-platform#447 · Filter by author cristim opened on Sep 28, 2026

• sec(auth): TOTP replay window and no lockout on MFA lifecycle failures (follow-up to #94)

  effort/mimpact/all-userspriority/p2severity/mediumtriagedtype/securityurgency/this-quarter
  LeanerCloud/cloud-commitments-platform#442 · Filter by author cristim opened on Sep 28, 2026
  1

• ci(deploy): Azure log step should run on failure; stop swallowing terraform output errors; add tests for health-check scripts

  effort/spriority/p3type/chore
  LeanerCloud/cloud-commitments-platform#438 · Filter by author cristim opened on Sep 28, 2026

• sec(api): unauthenticated cancel/revoke distinguish missing (404) from existing (401) executions

  effort/xspriority/p3type/security
  LeanerCloud/cloud-commitments-platform#435 · Filter by author cristim opened on Sep 28, 2026

• fix(frontend): 'Submitted (awaiting approval)' note omits the account on multi-account fan-out

  effort/xspriority/p3type/bug
  LeanerCloud/cloud-commitments-platform#434 · Filter by author cristim opened on Sep 28, 2026

• sec(auth): AccountScope.Allows grants every account that shares an allowed display name

  effort/spriority/p3type/security
  LeanerCloud/cloud-commitments-platform#433 · Filter by author cristim opened on Sep 28, 2026

• sec(api): approve returns the orphan-preflight 409 before any session or scope check

  effort/spriority/p3type/security
  LeanerCloud/cloud-commitments-platform#432 · Filter by author cristim opened on Sep 28, 2026

• fix(frontend): payment option silently defaults to all-upfront on the purchase path

  effort/xspriority/p2severity/mediumtype/bug
  LeanerCloud/cloud-commitments-platform#431 · Filter by author cristim opened on Sep 28, 2026

• chore(db): drop the raw approval_token columns (contract step after #416)

  effort/simpact/internalpriority/p3severity/lowtriagedtype/securityurgency/this-quarter
  LeanerCloud/cloud-commitments-platform#422 · Filter by author cristim opened on Sep 28, 2026

• ResetTokenStatus reports a deactivated user's reset token as valid

  effort/simpact/fewpriority/p3severity/lowtriagedtype/bugurgency/eventually
  LeanerCloud/cloud-commitments-platform#421 · Filter by author cristim opened on Sep 28, 2026

• test(auth): pin that a self-edit adding a non-admin permission the actor lacks is refused

  effort/xspriority/p3type/chore
  LeanerCloud/cloud-commitments-platform#419 · Filter by author cristim opened on Sep 28, 2026

• sec(purchase): refuse mismatched client discriminators when execute omits the recommendation id

  effort/spriority/p2type/security
  LeanerCloud/cloud-commitments-platform#418 · Filter by author cristim opened on Sep 28, 2026

• sec(purchase): constraint checks read recs before the CAS; execution buys from the post-CAS row (TOCTOU)

  effort/spriority/p2type/security
  LeanerCloud/cloud-commitments-platform#415 · Filter by author cristim opened on Sep 28, 2026

• test(frontend): end-to-end Escape-close regression for #331 with modal.ts unmocked

  effort/xspriority/p3type/chore
  LeanerCloud/cloud-commitments-platform#414 · Filter by author cristim opened on Sep 28, 2026

• test(frontend): assert every #plan-service optgroup in index.html carries a valid data-provider

  effort/xspriority/p3type/chore
  LeanerCloud/cloud-commitments-platform#413 · Filter by author cristim opened on Sep 28, 2026

• sec(iac/aws): CloudFront in front of Fargate ALB, guard against exposed ALB when compute_platform=fargate

  effort/mimpact/fewpriority/p2severity/mediumtriagedtype/securityurgency/this-quarter
  LeanerCloud/cloud-commitments-platform#412 · Filter by author cristim opened on Sep 28, 2026

• Extend recommendation storage/scheduler identity to include purchase-critical Details (tenancy/platform/scope/az_config)

  effort/mimpact/fewpriority/p2severity/lowtriagedtype/choreurgency/this-quarter
  LeanerCloud/cloud-commitments-platform#408 · Filter by author cristim opened on Sep 28, 2026

• sec(auth): enforce per-permission Constraints on ladder/config/RI-exchange-config/marketplace/revoke (SEC-01 follow-up to #60)

  effort/mimpact/all-userspriority/p1severity/hightriagedtype/security
  LeanerCloud/cloud-commitments-platform#404 · Filter by author cristim opened on Sep 28, 2026
  2

• sec(auth): API-key revocation durability, role_arn host-identity check, openapi base64 note (follow-ups to #392/#393/#396)

  effort/mimpact/fewpriority/p1severity/hightriagedtype/securityurgency/this-sprint
  LeanerCloud/cloud-commitments-platform#402 · Filter by author cristim opened on Sep 28, 2026

• chore: provision (or remove) the SQS queue and Lambda event source mapping for async purchase execution

  effort/mimpact/fewpriority/p2severity/mediumtriagedtype/choreurgency/this-quarter
  LeanerCloud/cloud-commitments-platform#399 · Filter by author cristim opened on Sep 28, 2026

• auth: password-rotation credential invalidation is best-effort, not atomic

  effort/limpact/fewpriority/p2severity/lowtype/security
  LeanerCloud/cloud-commitments-platform#398 · Filter by author cristim opened on Sep 28, 2026

• chore: minor follow-ups from the #373/#376/#380/#383 reviews

  effort/simpact/fewpriority/p3severity/lowtriagedtype/choreurgency/this-quarter
  LeanerCloud/cloud-commitments-platform#394 · Filter by author cristim opened on Sep 28, 2026

• fix(api): plan/run-now/revoke follow-ups from the #360/#370/#381 reviews (ramp shape change, lock, error mapping, revoke-any scope)

  effort/mimpact/manypriority/p1severity/hightriagedtype/bugurgency/this-sprint
  LeanerCloud/cloud-commitments-platform#386 · Filter by author cristim opened on Sep 28, 2026