[
  {
    "bug_id": "IDOR / Missing Auth",
    "previous_issue": "Unauthenticated client can send messages/turns to any session ID",
    "current_status_code": 200,
    "fixed": false,
    "evidence": "Request to /v1/onboarding/ONB-270B683F/message returned status code 200 (Expected 401/403)"
  },
  {
    "bug_id": "Session Hard Deletion",
    "previous_issue": "Completed session is hard-deleted from DB, causing misleading 404 error on second call",
    "current_status_code": 404,
    "fixed": false,
    "evidence": "Second call to /complete returned status 404, body: {'detail': 'Onboarding session not found'}"
  },
  {
    "bug_id": "CORS Policy",
    "previous_issue": "Access-Control-Allow-Origin: * combined with Access-Control-Allow-Credentials: true",
    "current_status_code": 200,
    "fixed": false,
    "evidence": "Access-Control-Allow-Origin: '*', Access-Control-Allow-Credentials: 'true'"
  },
  {
    "bug_id": "Age Validation",
    "previous_issue": "Negative age (age = -50) accepted with 200 OK",
    "current_status_code": 200,
    "fixed": false,
    "evidence": "POST /v1/onboarding/start with age=-50 returned status code 200"
  },
  {
    "bug_id": "Rate Limiting",
    "previous_issue": "No rate limiting attached to session creation / AI endpoints",
    "current_status_code": [
      200,
      200,
      200,
      200,
      200,
      200,
      200,
      200,
      200,
      200
    ],
    "fixed": false,
    "evidence": "Status codes for 10 rapid requests: [200, 200, 200, 200, 200, 200, 200, 200, 200, 200]"
  }
]