Issues

• [Bug] Dead validation message key phone_number.digits doesn't match actual rule

  bugseverity:low
  MuhammedMSalama/ChatMessage#32 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Bug] Duplicate conflicting keys in Pusher broadcasting config

  bugseverity:low
  MuhammedMSalama/ChatMessage#31 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Tests] No feature tests covering chat endpoints / auth ownership boundaries

  severity:mediumtests
  MuhammedMSalama/ChatMessage#30 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Performance] Missing composite indexes on chat_messages for hot query paths

  performanceseverity:medium
  MuhammedMSalama/ChatMessage#29 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Performance] Unpaginated chat history / all-chats / contacts endpoints

  performanceseverity:medium
  MuhammedMSalama/ChatMessage#28 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Performance] N+1 queries in getChatHistory; preventsLazyLoading flag is a no-op

  bugperformanceseverity:high
  MuhammedMSalama/ChatMessage#27 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Bug] SendMessageRequest::failedValidation always returns wrong error message

  bugseverity:high
  MuhammedMSalama/ChatMessage#26 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Bug] phone_number and email_verified_at silently dropped on registration (not in $fillable)

  bugseverity:high
  MuhammedMSalama/ChatMessage#25 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Bug] ResponseHelper called with wrong argument order throughout AuthRepository

  bugseverity:high
  MuhammedMSalama/ChatMessage#24 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Security] Real-looking Pusher credentials and APP_KEY committed in .env.example

  securityseverity:critical
  MuhammedMSalama/ChatMessage#23 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Security] Sender spoofing — sender_id trusted from request body instead of auth()->id()

  bugsecurityseverity:critical
  MuhammedMSalama/ChatMessage#22 · Filter by author MuhammedMSalama opened on Oct 27, 2026

• [Security] Chat endpoints lack ownership checks (IDOR)

  bugsecurityseverity:critical
  MuhammedMSalama/ChatMessage#21 · Filter by author MuhammedMSalama opened on Oct 27, 2026