1. [security] `apps/nim/src/app.nim:57` — Titles reach `unicode.strip` without UTF-8 validation. A POST to `/todos` with `title=%80` triggers an out-of-bounds `IndexDefect` in Nim’s Unicode implementation. The handler catches only `CatchableError`, so the defect escapes through `asyncCheck` and terminates the shared server, interrupting every visitor. Validate decoded titles before trimming.
2
3
2. [correctness] `apps/nim/src/store.nim:181` — `$column_text(st, 1)` reads a NUL-terminated string, although insertion preserves the full byte length. Posting `title=before%00after` stores the complete title but retrieves only `before`; subsequently saving the displayed title loses the suffix. Read SQLite text using `column_bytes` so embedded U+0000 does not truncate it.
amadan