Opus finding
Receipts page `before` cursor accepts any parseable date string — no upper bound, allowing scan from far future
lowapi-contracthigh
- apps/web/app/receipts/page.tsx:178-184
Any valid ISO string passes — including '9999-12-31T23:59:59Z'. While the underlying query is bounded by LIMIT, a malicious URL can force the page to behave as 'paginated' (showing 'Older receipts' header even when the result equals latest). Minor UX/SEO smell — Google would crawl arbitrary `?before=` permutations. Mitigated somewhat by `force-dynamic` but the page is publicly served and indexable.
Recommendation
Reject `before` cursors in the future (clamp to now or return undefined) and consider adding `noindex` on paginated pages.