GitHub Bounties💵 paid workby daniel7anscored by google/gemini-2.5-flash

SecureBananaLabs/bug-bounty: Notification creation should preserve server-owned id and read state

Visit project ↗Discussion ↗

💵 Funded work— see “Deliver it” below for how to respond.

Opportunity

AI-buildable

Traction

Creativity

The take

effort: ~weekend

This is a bounty to fix a bug in a notification service where a POST request for creating a notification can override the server-generated ID and the initial unread state. The fix requires ensuring server-generated IDs are always used and new notifications always start as unread, ignoring any caller-supplied values for these fields during creation.

Demand & gap

Painkillerdemand 82

Demand

Will. to pay

Gap

Buyer

Developers

The gap in what exists: The gap is the unmet need for this specific bug fix within the SecureBananaLabs project, for which they are explicitly paying.
Wedge to win: Deliver a robust, well-tested fix quickly and clearly demonstrate its adherence to the specified requirements to claim the bounty.
Reputation value (worth doing free for proof) — 75/100: A merged PR to a public bug bounty project demonstrates strong coding skills and the ability to contribute to existing codebases, directly applicable to future freelance or dev-tool client work.
Likely monetization: bounty payment
Incumbents to beat: Other developers working on the same bounty issue

Deliver it

A starter prompt for Claude Code, what you'll need, and how to reach them.

You are an expert software developer. Your task is to implement a fix for issue #2762 in the SecureBananaLabs/bug-bounty repository. The core problem is that notification creation allows overriding server-generated IDs and the initial 'read' state. Your solution should ensure:
1.  The `id` field is always generated by the server and cannot be supplied by the caller.
2.  New notifications always start with `read: false`, regardless of what the caller provides.
3.  Caller-supplied `id` and `read` fields are ignored during the creation process.

Focus solely on the notification creation logic. Do not alter authentication or routing. The project is likely a Node.js/Express application. Assume a PostgreSQL database for persistence, interacting via an ORM like Prisma or Sequelize. You should fork the repository, make the changes, and include unit tests for the notification creation endpoint that specifically test these new constraints. Your primary goal is to produce a PR that is ready for review. The stack should align with typical modern web service practices (e.g., Node.js, Express, a common ORM, Jest for testing).

Prerequisites — cost & what to learn

GitHub account

How you'd build it

1Fork the SecureBananaLabs/bug-bounty repository.
2Locate the notification creation endpoint logic within the service.
3Implement logic to ignore `id` and `read` fields if present in the incoming payload during creation.
4Ensure the notification `id` is always generated by the server and `read` state is initialized to `false`.
5Write unit/integration tests to confirm the fix works as expected.
6Open a pull request to the original repository with the fix and tests.

Risks & moats

Understanding the existing codebase and notification service architecture might take longer than anticipated.
The bounty might be claimed by another developer before the fix is completed.
Submitting a PR that doesn't fully adhere to their coding standards or scope might require rework.
The project dependencies might be complex or unfamiliar.

Market it to your portfolio

fit 60

Forge KitRepo Gardener

Developers contributing to open-source bounties are actively looking for tools to streamline their development workflow; a tool like Forge Kit could help manage their project fleet, or Repo Gardener could help them find other maintenance opportunities.

Original context

Bounty (amount on the issue). Parent bounty: #743 ## Bug The notification service currently creates records with `{ id: generated, read: false, ...payload }`, so a request body can override both the generated notification id and the initial unread state. That lets callers create notifications already marked as read or collide with reserved/generated ids. ## Expected - Notification creation should always return a server-generated id. - New notifications should always start with `read: false`. - Caller-supplied `id` and `read` fields should be ignored during creation. ## Scope Keep this limited to notification creation. Do not change auth or route behavior in this PR. Related reissue: #2742