Check if this issue is valid — if so, understand the root cause and fix it. At packages/core/src/lib/auth/email-confirmation.service.ts, line 167:

<comment>TOCTOU race condition: The comment claims the update "scopes by id + code + codeExpireAt" but the actual `update(user['id'], ...)` call only scopes by `id`. Two concurrent requests can both read the same valid code, both pass validation, and both proceed — the verification code reuse is not actually prevented.

To fix this properly, the UPDATE's WHERE clause must include `code` and `codeExpireAt` (not just `id`), and you need to check that `affected` rows > 0. For example, using a query builder:
```typescript
const result = await getManager()
  .createQueryBuilder()
  .update(User)
  .set({ code: null, codeExpireAt: null })
  .where({ id: user['id'], code, codeExpireAt: MoreThanOrEqual(new Date()) })
  .execute();
if (!result.affected) {
  throw new BadRequestException('Verification code already used or expired.');
}
```</comment>

<file context>
@@ -150,26 +148,27 @@ export class EmailConfirmationService {
+				// Atomically invalidate the verification code (prevent reuse / TOCTOU race) // cspell:ignore TOCTOU
+				// The update scopes by id + code + codeExpireAt so a concurrent request
+				// that already nullified the code will update zero rows
+				await this.userService.update(user['id'], {
+					code: null,
+					codeExpireAt: null
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At packages/config/src/lib/environments/environment.prod.ts, line 66:

<comment>Calling `validateProductionSecrets()` at module load time in `environment.prod.ts` will execute in the browser bundle as part of the Angular prod environment. Since browser builds don’t have backend JWT secrets, this throws and breaks the production frontend. Guard this so it only runs on the server (or move the validation to backend startup).</comment>

<file context>
@@ -11,6 +11,60 @@ import { FileStorageProviderEnum } from '@gauzy/contracts';
+}
+
+// Validate JWT secrets at module load time (production only)
+validateProductionSecrets();
+
 if (process.env.IS_ELECTRON && process.env.GAUZY_USER_PATH) {
</file context>

Check if this issue is valid — if so, understand the root cause and fix it. At .github/workflows/desktop-timer-app-stage.yml, line 428:

<comment>Building PATH with an empty `$yarnPath` inserts an empty segment (`;;`), which on Windows resolves to the current working directory. This unintentionally adds the workspace to PATH and can lead to executing unintended binaries. Filter out empty entries before joining.</comment>

<file context>
@@ -408,18 +408,35 @@ jobs:
+          $localNodeExe = Join-Path $localBin "node.exe"
+          if (-not (Test-Path $localNodeExe)) { Copy-Item $nodeExe $localNodeExe -Force }
+
+          $newPath = "$nodePath;$npmGlobalBin;$localBin;$yarnPath;$($env:PATH)"
+          "PATH=$newPath" | Out-File -FilePath $env:GITHUB_ENV -Append -Encoding utf8
+
</file context>