Roadmap

v0.1.0 MVP ✅ Released

[x] Project scaffolding — 6 crates, SQLite schema
[x] OAuth callback handlers (Google, GitHub, Keycloak)
[x] JWT session middleware + CurrentUser extractor
[x] REST API — Posts, Votes, Comments, Projects CRUD (12 endpoints)
[x] SvelteKit 5 frontend — Board, Post detail, Auth, Admin (5 pages)
[x] shadcn-svelte UI (button, card, badge, input, textarea)
[x] Docker — 3-stage build (frontend → Rust → scratch), multi-arch
[x] CI/CD — 11 checks (check, fmt, clippy, test, build, audit, trivy, cora, docker)
[x] OpenAPI/Swagger UI at /swagger-ui
[x] VitePress documentation site
[x] Security hardening (SQL injection fix, CORS, cookie, auth guards)
[x] Tests — 67 total (47 Rust + 20 TypeScript)

Critical/high-severity findings from cora scan v0.6.0 (2026-06-17). Patch bump from v0.1.1.

[x] 🔴 #54 — MCP server documented as unauthenticated with direct DB access (auth bypass)
[x] 🔴 #55 — Email-only account linking enables cross-provider account takeover
[x] 🟠 #57 — OAuth flow: redirect lost, provider errors leaked, HTTP client rebuilt per request, weak cookie parse
[x] #53 — Docs: correct misleading "first user becomes admin" (actual: ADMIN_EMAILS allowlist)

Plus the four grouped scan issues #56, #58, #59, #60 and the docs-sync follow-up #70.

Validation artifact: .cora/scan-validation-2026-06-17.md

Feature polish for the feedback board. Issues are grouped by area; click through for full scope.

[ ] #73 — Email notifications (new comments, status changes) — largest item, consider splitting across PRs
[x] #74 — Image attachments on posts
[x] #76 — Keyboard shortcuts (board navigation, help overlay) — good standalone starter

#76 (keyboard shortcuts) — smallest, builds the action/help infrastructure other features can reuse.
#72 (FTS5 search) — completes an already-advertised feature; high user value per LOC.
#75 (roadmap view) + #77 (changelog) — share UI patterns, land together.
#74 (attachments) — schema + storage work, self-contained.
#73 (email notifications) — largest, multiple PRs; do last.