Known Issues

2 Critical 5 High 8 Medium 6 Low Last updated: September 2026

All known bugs, security vulnerabilities, and limitations in AquaDealers v3.0.0. Sorted by severity.

Critical Security Vulnerabilities

These issues pose immediate security risk and should be resolved before any feature work.

#	Issue	Area	Details	Recommended Fix
1	Service role key committed to repo	Security	`scripts/migrate/.env.migration` contains plaintext `service_role` key and dealer password. File is in `.gitignore` but exists in working tree.	Rotate key immediately in Supabase dashboard. Scrub from git history with `git filter-repo`.
2	`farmer_return_credit_applications` missing RLS	Security	Table was created without `ENABLE ROW LEVEL SECURITY`. Any authenticated user can read/write any dealer's return credit data.	`ALTER TABLE farmer_return_credit_applications ENABLE ROW LEVEL SECURITY;` + add dealer-scoped policy.

High Severity

#	Issue	Area	Details	Recommended Fix
3	Admin RPCs callable by anon	Security	All `admin_*` functions have `GRANT EXECUTE` to the `anon` role. Unauthenticated requests can invoke admin operations.	`REVOKE EXECUTE` from `anon`. Grant only to `authenticated` with admin session verification inside each RPC.
4	Storage buckets publicly readable	Security	`farmer-profiles` and `product-images` buckets are `public = true`. Farmer photos accessible without authentication.	Set `public = false` on both buckets. Add RLS policies requiring authenticated + dealer match.
5	`pin_hash` leaked in admin RPC	Security	`admin_get_dealer_profile` returns the dealer's `pin_hash` in its response.	Exclude `pin_hash` from the SELECT in the RPC function body.
6	Bill PDF freezes mobile 3-5s	Performance	`html2canvas` at `scale: 2` blocks the main thread on mobile devices for 3-5 seconds during PDF generation.	Move PDF generation to a Supabase Edge Function (server-side). Use Puppeteer or a headless renderer.
7	Monthly report unbounded fetch	Performance	`reportsService.ts` lines 60-180 fetch ALL bills, purchases, and expenses for a month with no pagination or limits.	Create server-side aggregation RPCs that return pre-computed totals instead of raw rows.

Medium Severity

#	Issue	Area	Details	Recommended Fix
8	GST display mismatch	Billing	ProductSelector (Step 1) uses a flat 18% GST rate. ReviewStep (Step 3) uses the per-item `gst_rate`. Totals can differ between steps.	Use `product.gst_rate` consistently in both steps.
9	No round-off field on bills	Billing	Indian dealers commonly round totals to the nearest rupee. No `round_off` column exists.	Add `round_off NUMERIC(10,2) DEFAULT 0` to bills table. Include in bill creation and display.
10	Staff permissions client-side only	Security	Staff JSONB permissions control sidebar visibility and UI gates, but RLS policies grant full data access to any authenticated staff member.	Add permission checks inside RPCs: verify `staff.permissions` JSONB contains required permission before executing.
11	`getDuesSummary` fetches 10,000 rows	Performance	`dashboardService.ts:185` pulls up to 10,000 farmer rows to compute dues summary on the client.	Create a server-side aggregation RPC that returns sum/count directly.
12	Dashboard 15+ queries on cold load	Performance	Dashboard fires 15+ parallel queries on mount. Each is small but the combined round-trip overhead is significant on slow connections.	Create a single `get_dashboard_summary` RPC that returns all KPIs in one call.
13	No admin login rate limiting	Security	Admin authentication has no brute-force protection. Staff PIN auth has a rate-limit trigger, but admin login does not.	Add a rate limit check similar to the staff PIN `enforce_rate_limit` trigger.
14	CORS wildcard on WhatsApp edge function	Security	WhatsApp edge function returns `Access-Control-Allow-Origin: *`. Any origin can call the function.	Restrict to the app's domain(s) only.
15	*35+ queries use `select('')`**	Performance	Over 35 Supabase queries fetch all columns. Wastes bandwidth, especially on tables with large text/JSON columns.	Specify only the columns needed in each query.

Low Severity

#	Issue	Area	Details	Recommended Fix
16	No dark mode	UI	`color-scheme: light` is hardcoded. No dark theme tokens defined.	Define dark-mode CSS custom properties. Add toggle in settings.
17	No tablet layout	UI	768-1024px viewport gets the mobile layout. Wastes screen space on tablets.	Add a tablet breakpoint with adapted grid layouts.
18	Legacy unused components	Code	`TopBar.tsx`, `DesktopNav.tsx`, `shareUtils.ts` are unused but still in the codebase.	Delete the dead files.
19	Duplicate PlanGate component	Code	Two separate PlanGate component files exist in the project.	Consolidate into one and update all imports.
20	Missing `loading="lazy"` on images	Performance	Most `<img>` tags lack lazy loading. Only `FarmerAvatar` has it.	Add `loading="lazy"` to all below-the-fold images.
21	Cashbook no pagination	Performance	Cashbook page fetches all entries without pagination. Slow for dealers with months of data.	Add cursor-based pagination to the cashbook query.