aitesis: 5 low-severity audit findings (wave-1 batch)

[forkwright]

Findings

correctness

• crates/aitesis/src/repo.rs:218 — RequestRow::into_domain silently drops malformed rows with no warning (low)

resilience

• crates/aitesis/src/lib.rs:124 — Request limit check is non-atomic with insert — concurrent submissions can exceed per-user limits (low)
• crates/aitesis/src/limits.rs:25 — Rate-limit check and request insert are not atomic, allowing limit bypass under concurrency (low)
• crates/aitesis/src/repo.rs:249 — list_all and list_by_user have no LIMIT — unbounded allocation for large libraries (low)

testing

• crates/aitesis/src/lib.rs:159 — No test: auto_approve identity validation failure leaves orphaned Approved request (low)

Note

These are batched low/info findings; split any out if it gets prioritized.