Here an example of it taking arbitrary input and blindly casting it to a type; anything after this point can blow up. There seems to be no input validation anyw

Here an example of it taking arbitrary input and blindly casting it to a type; anything after this point can blow up. There seems to be no input validation anywhere. const input = req.body as SyncMutationsInput; https://github.com/colanode/colanode/blob/9e69f29858a2ced6b1bd33b62993e154a1c91304/apps/server/src/api/client/controllers/workspaces/mutations/mutations-sync.ts#L32 https://github.com/colanode/colanode/blob/9e69f29858a2ced6b1... And the database use looks racy, sometimes not using transactions at all but having a read-modify-write cycle, no GET FOR UPDATE seen anywhere in transactions. Somebody is going to figure out how to do nasty things to the data.