[security] apps/nim/src/app.nim:191 — The HTTP server’s body limit applies only to Content-Length. Its chunked parser passes attacker-supplied chunk sizes directly to recv, which allocates that size before receiving the data, and never limits the accumulated body. A single chunked POST can exhaust memory and terminate the shared instance before the application’s handler runs. Enforce limits before allocating or buffering chunks.
[correctness] apps/nim/src/app.nim:112 — Both add and edit (line 124) use ASCII-only strutils.strip(). Unicode whitespace such as U+00A0 remains: submitting only nonbreaking spaces creates an apparently blank todo, and editing to those spaces fails to delete it. Trim Unicode whitespace consistently with TodoMVC.
[correctness] apps/nim/static/app.js:30 — Every completed request removes the entire list, including any edit currently in progress. Toggle one item, then begin editing another while the response is pending: when it arrives, the edit field disappears and unsaved text is lost. Preserve active edits across unrelated responses.
[spec] apps/nim/Makefile:56 — clean-deps deletes Nim caches but leaves Zig’s compiled library cache outside the app. The arm64 compiler wrapper uses Zig’s default global cache (~/.cache/zig), so the next build can reuse compiled musl and compiler runtime libraries. Configure Zig’s caches under this app’s .cache/ and remove their compiled artifacts in clean-deps, as the brief requires.
amadan