Sprint Delivery Board

Implement WA Flows

Use Veripay instead of organization name in Paymob ARE sender fields

Integrate Atlas Pay into the system as a GPS partner

ID type and ID number should be mandatory for INR transactions on frontend in GPS

New branding Visual on login page

Travel Rule Post-Transaction + Initiator Flow Case Handling & Testing

PenTest June 2026

Create Dashboards for traces on grafana

Upgrade legacy WhatsApp chatbot to gpt-5.4-mini + Responses API (reduce hallucinations)

Maker Checker for Bank Account and Wallet Creation in Client Dashboard

Client based Quotation Duration

Allow payout via GPS and withdrawal directly from Sub account

Onboarding: UBOs

Add OpenTelemetry tracing to all backend services

Sync revamped KYC in manual KYC verify/unverify

[VAPT][Medium] Webhook Signing Secret Tampering

[VAPT][Medium] Invitation Endpoint Allows Duplicate Invitations via Race Condition

[VAPT][Low] Bcrypt Password Hash Disclosure via Invitations Endpoint

[VAPT][Info] Missing Server-Side CSRF Defenses

[VAPT][Medium] Publicly Accessible MCP Server

[VAPT][Medium] Sensitive Credential Disclosure via Admin Endpoints

[VAPT][Medium] Inventory Item Endpoint Accepts Negative Quantities and Rates

[VAPT][Medium] Admin Permission Catalogue Disclosure to Read-Only Users

[VAPT][Medium] Improper Invalidation of Password Reset Tokens

[VAPT][Medium] Session Token Remains Valid After Logout

[VAPT][Low] Multiple Session Persistence

In partner monitoring page, EzRemit is not showing rate

Coinsph payout executeQuote failures logged as "Unknown error" instead of actual partner error code

Gate Vaults UI/UX Improvements

Sub-accounts

Auto-fail completed transactions on non-credit claim and cancelled errors

[VAPT][Critical] Cross-Org Webhook Transfer via orgId

[VAPT][Critical] SSRF via Webhook URL Leading to AWS Instance Metadata Disclosure

[VAPT][High] API-Key IP Allowlist Bypass

Wallets missing external ID can block withdrawals

Migrate Fireblocks to v2

Store checkout received amount in request currency (Fiat) and USD equivalents

Revamp fireblocks vault creation and wallet assignment for checkouts

Create Backfill Script for Missing Fiat and USD Amounts in Historical Checkout Records

Fix onboarding flow branch inconsistencies caused by incorrect git actions

Add error code to transaction response and webhook

Improve Redis Viewer

Create a OTel config for traces in Grafana

Add cicd pipelines to all microservice repositories

[VAPT][Low] Lack of Global Server-Side Input and Output Validation

[VAPT][High] Privilege Escalation: Low-Privilege User Can Disable Admin Accounts

[VAPT][High] Unauthenticated Redis-Viewer Access

Paymob SAU watchdog misses refunded with fees and VAT status

Create logs dashboards for staging and prod in grafana

Update Paymob implementation to use sanitized sender details when provided

Fix empty string validation in transaction input and add gender dropdown