[security] apps/nim/src/app.nim:57 — Titles reach unicode.strip without UTF-8 validation. A POST to /todos with title=%80 triggers an out-of-bounds IndexDefect in Nim’s Unicode implementation. The handler catches only CatchableError, so the defect escapes through asyncCheck and terminates the shared server, interrupting every visitor. Validate decoded titles before trimming.
[correctness] apps/nim/src/store.nim:181 — $column_text(st, 1) reads a NUL-terminated string, although insertion preserves the full byte length. Posting title=before%00after stores the complete title but retrieves only before; subsequently saving the displayed title loses the suffix. Read SQLite text using column_bytes so embedded U+0000 does not truncate it.
amadan