todo.md

From code review

• OAuth CSRF: add state parameter to OAuth flow to prevent CSRF attacks
• Token leakage: tokens embedded in git push CLI args are visible in /proc; release() returns authenticated URLs to frontend
• save_config panics: expect() in HTTP handlers will crash the server on disk errors — return Result instead
• Read lock held during move: move_repo holds registry lock for the entire clone/push duration, blocking provider management
• No error recovery: failed moves leave ghost cards with no rollback
• set_token silently fails if lock is held — make it infallible
• No pagination guard: GitHub/Gitea list loops could run forever
• API_BASE hardcoded in two files — extract to shared constant
• No input validation on repo_id/provider_id used in URL construction
• CorsLayer::permissive() allows any origin — restrict to frontend_url
• No request body size limits on server
• REST verbs: delete/archive use POST instead of DELETE/PATCH