1. [security] `apps/nim/src/app.nim:191` — The HTTP server’s body limit applies only to `Content-Length`. Its chunked parser passes attacker-supplied chunk sizes directly to `recv`, which allocates that size before receiving the data, and never limits the accumulated body. A single chunked POST can exhaust memory and terminate the shared instance before the application’s handler runs. Enforce limits before allocating or buffering chunks.
2
3
2. [correctness] `apps/nim/src/app.nim:112` — Both add and edit (line 124) use ASCII-only `strutils.strip()`. Unicode whitespace such as U+00A0 remains: submitting only nonbreaking spaces creates an apparently blank todo, and editing to those spaces fails to delete it. Trim Unicode whitespace consistently with TodoMVC.
4
5
3. [correctness] `apps/nim/static/app.js:30` — Every completed request removes the entire list, including any edit currently in progress. Toggle one item, then begin editing another while the response is pending: when it arrives, the edit field disappears and unsaved text is lost. Preserve active edits across unrelated responses.
6
7
4. [spec] `apps/nim/Makefile:56` — `clean-deps` deletes Nim caches but leaves Zig’s compiled library cache outside the app. The arm64 compiler wrapper uses Zig’s default global cache (`~/.cache/zig`), so the next build can reuse compiled musl and compiler runtime libraries. Configure Zig’s caches under this app’s `.cache/` and remove their compiled artifacts in `clean-deps`, as the brief requires.
amadan