Critical / Security
| # | Bug | Lokasi | Deskripsi |
|---|---|---|---|
| 1 | Hardcoded superadmin credentials | AdminSeeder.php, DatabaseSeeder.php | Password ochvIui8q3wpagv di-commit ke VCS |
| 2 | Auto-create superadmin | AdminController.php:22-35 | Login page auto-create superadmin@gmail.com/superadmin jika collection kosong |
| 3 | PersonalAccessToken::updated() bug | AdminController.php:56 | updated() adalah event method, bukan query — silently does nothing |
| 4 | Loose phone matching covendor | CovendorOrderController.php | like '%nohp%' collision-prone |
| 5 | DB::transaction no-op | WithdrawController.php | MongoDB standalone — transaction tidak berfungsi |
High
| # | Bug | Lokasi | Deskripsi |
|---|---|---|---|
| 6 | Stray dd() di production | LiveChatController.php:71 | dd($data['contacts']->toArray()) akan kill page |
| 7 | Password overwrite bug | UserController.php | bcrypt($request->password) ?? ... — ?? never triggers |
| 8 | Addon yearly expiry bug | OrderController.php:179 | else if ($d_satuan == 'Year') — cek $d_satuan bukan $addon_d_satuan |
| 9 | N+1 query di performance | PackageController.php | Per-package count + sum queries |
Correctness
| # | Bug | Lokasi | Deskripsi |
|---|---|---|---|
| 10 | Date stored as string | Store.php, OrderController.php | expired_at disimpan sebagai 'Y-m-d H:i' string, dibandingkan lexicographically |
| 11 | Duration string parsing | OrderController.php | explode(' ', $duration) — tidak ada enum, typo break expiry math |
| 12 | Controller instantiation | OrderController.php | new PaymentController() — bukan DI |
| 13 | Mixed MongoDB + MySQL | LiveChatController.php | MongoDB Eloquent + raw MySQL query builder dalam flow sama |
| 14 | Dead model imports | LiveChatController.php | Import model yang tidak ada (ChatHistory, ChatOrder, Contact, HandleGudang, Setting) |
| 15 | Typo filename | QuickLoginControler.php | Controler → seharusnya Controller |
| 16 | Typo TicketingfeedbackController | routes/web.php:196-197 | Class name case mismatch dengan TicketingFeedbackController |
Performance
| # | Issue | Lokasi | Deskripsi |
|---|---|---|---|
| 17 | No queue | .env | QUEUE_CONNECTION=sync — semua job synchronous |
| 18 | No index strategy | MongoDB | Tidak ada index definition untuk query yang sering dipakai |
Frontend
| # | Issue | Lokasi | Deskripsi |
|---|---|---|---|
| 19 | Velzon demo pages shipped | resources/js/Pages/ | Template demo pages (dashboards/*, auth-pages/*) masih ada |
| 20 | No auto-refresh on 409 | Withdraw page | Tidak ada handling khusus saat receive 409 (double approval) |
Deployment
| # | Issue | Lokasi | Deskripsi |
|---|---|---|---|
| 21 | Branch produksi tidak jelas | — | Perlu konfirmasi apakah main atau master |
| 22 | No CI/CD | — | Tidak ada GitHub Actions workflow |