Issues

• Test suite is a single tautological assertion — zero business logic, classification, or Edge Function behavior is tested

  Thanas-R/Virdis#12 · Filter by author tg12 opened on May 20, 2026

• All Edge Functions pin deno.land/std@0.168.0 (~2.5 years old) — missing 50+ versions of security and HTTP fixes

  Thanas-R/Virdis#11 · Filter by author tg12 opened on May 20, 2026

• GEE auth and expression helpers copy-pasted identically across 4 Edge Functions — security patches will be missed

  Thanas-R/Virdis#10 · Filter by author tg12 opened on May 20, 2026

• No polygon input validation in GEE Edge Functions — unbounded vertex count and coordinate range accepted

  Thanas-R/Virdis#9 · Filter by author tg12 opened on May 20, 2026

• Wildcard CORS (Access-Control-Allow-Origin: *) on all 8 Edge Functions enables cross-origin credential exfiltration

  Thanas-R/Virdis#8 · Filter by author tg12 opened on May 20, 2026

• No rate limiting on any Edge Function — ndvi-timeseries amplifies one HTTP request to 40 GEE API calls

  Thanas-R/Virdis#6 · Filter by author tg12 opened on May 20, 2026

• gee-ndvi-tiles returns the GEE service-account OAuth access token in the HTTP response body

  Thanas-R/Virdis#5 · Filter by author tg12 opened on May 20, 2026

• get-mapbox-token Edge Function returns live Mapbox API token to any unauthenticated caller

  Thanas-R/Virdis#4 · Filter by author tg12 opened on May 20, 2026

• All 8 Edge Functions disable JWT auth and expose paid AI/GEE/Mapbox APIs to unauthenticated callers

  Thanas-R/Virdis#3 · Filter by author tg12 opened on May 20, 2026
  4