# Reported issues for suwappu

Pod holds 13 of 13 problems reported by people outside the maintainer team. Issues filed by the project's own owners, members and collaborators are excluded entirely — a maintainer's release checklist is not a warning to a prospective user.

Back to [suwappu](/mcp/suwappu).

## Most discussed

### /goal: developer platform parity — evidence-complete, no exceptions

# /goal — Suwappu developer platform parity

Bring Suwappu's developer platform to **evidence-backed parity with top infrastructure APIs**, not just similar documentation or feature count.

Benchmark set: Stripe, Cloudflare, Supabase, Alchemy, Plaid, Circle, Fireblocks, Twilio, Turnkey, Privy, 0x, LI.FI, Vercel, and Temporal.

This issue is the completion contract. **Do not close it, call the platform “parity,” or increase the final parity score to 100% until every gate below is green and a fres

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/872) · 2026-08-21 · open · 2 comments

### [P5-1] A2A task store persistence

## Description
Replace in-memory A2A task store in `routes/a2a.ts` with PostgreSQL persistence.

## Blocked by
None — can start immediately

## Branch
`phase/5/p5-1-a2a-persistence` → PR to `dev`

## Definition of Done
> Agent loops until ALL conditions pass. Do not close until verified.

- [ ] `api-ts/src/db/schema/a2aTasks.ts` exists
- [ ] Tasks survive server restarts
- [ ] Expired tasks cleaned up automatically

## Required Tests (`api-ts/test/a2a-persistence.test.ts`)
> Must be committed wi

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/224) · 2026-03-07 · closed · 2 comments

### Third-party integration surface is drifting: SDK releases never publish, mcp-server is 5 months stale, README advertises versions that don't exist

Audit of what an external developer actually gets when they try to build on Suwappu. Every number below was checked against the live npm registry and the repo, not inferred.

### The release pipeline has never run

`.github/workflows/publish-sdk.yml` triggers only on `push: tags: ['v*']`. The GitHub Actions API reports **0 runs, ever**, and the repo has exactly one tag (`v0.4.0`). So SDK work merges to `main` and stops there.

### Three-way version drift

| Package | README claims | npm serves |

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/674) · 2026-08-01 · open · 1 comment

### [MONEY-PATH] admin_import_wallet: private-key-over-Telegram flow needs a security design, not an ad-hoc wire-up

Found during a dead-button sweep: the `admin_import_wallet` button (`bot/handlers/admin_custodial.py:84`) had no handler at all — tapping it did nothing.

The backing service **does** exist — `hot_wallet_service.import_hot_wallet()` accepts a raw private key string — so it would have been easy to wire a chat flow that prompts an admin to paste a key. That was deliberately **not** done: a private key typed into a Telegram chat hits Telegram's servers and persists in message history, and there is 

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/672) · 2026-08-01 · open · 1 comment

### [Security][ROTATE] Plaintext private key in memory during predict signing (R6)

**Severity:** High · **Type:** key-in-memory (rotation if host compromise suspected)
**Location:** `bot/handlers/predict.py:752-770`

**Issue:** A plaintext private key is held in process memory during predict signing, exposed to memory dumps/debuggers/core files. Best-effort zeroization was added elsewhere (H2) but this path needs review.

**Required action:**
1. Rotate keys only if a memory dump / host compromise is suspected (otherwise operational).
2. Minimize key lifetime in memory (zeroize

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/321) · 2026-06-07 · open · 1 comment

### [Security][ROTATE] Backup-key decryption has no 2FA/authorization gate (R4)

**Severity:** Critical · **Type:** key-handling (rotation if exploited)
**Location:** `bot/services/wallet.py:495-514`

**Issue:** `get_backup_private_key()` decrypts backup keys with no 2FA/authorization gate. Defense-in-depth (access guard + anomaly logging) was added in the hardening pass (H3), but if this path was already exercised by an attacker, the underlying keys are compromised.

**Required action:**
1. If exposure is suspected, rotate affected wallet keys + migrate funds.
2. Add a real

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/319) · 2026-06-07 · open · 1 comment

### [P2-2] api-ts Telegram auth route tests

## Description
Test `/webapp/validate` and `/webapp/telegram/auth` with mocked TelegramAuthService.

## Blocked by
#199 ([P2-1] — test infrastructure must exist first)

## Branch
`phase/2/p2-2-auth-tests` → PR to `dev`

## Definition of Done
> Agent loops until ALL conditions pass. Do not close until verified.

- [ ] `api-ts/test/webapp-auth.test.ts` exists and passes

## Required Tests
> Must be committed with the implementation. No merge without passing tests.

- [ ] `POST /webapp/validate ret

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/200) · 2026-03-07 · open · 1 comment

### Set ADMIN_API_KEY in AWS Secrets Manager

## Problem
`ADMIN_API_KEY` is empty in `suwappu/app-secrets`, preventing API-based health checks and admin operations.

## Requirements
1. Generate a secure API key
2. Add to `suwappu/app-secrets` in AWS Secrets Manager
3. Update API-TS to use it for admin endpoints

## Command
```bash
# Generate key
ADMIN_KEY=$(openssl rand -hex 32)

# Update secret (merge with existing)
aws secretsmanager update-secret --secret-id suwappu/app-secrets \
  --secret-string "$(aws secretsmanager get-secret-value -

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/91) · 2026-01-31 · closed · 1 comment

## Most recent

### G10: zero-to-first-success developer onboarding parity

Parent /goal: #872

Closes **G10 — Developer onboarding parity**.

## Benchmark property
Stripe/Supabase/Vercel/0x-class onboarding makes the recommended path obvious, gets a new integrator to a safe first success quickly, and makes authority/environment/retry semantics explicit before money moves.

## Work
- Define one canonical zero-to-first-success journey for REST/SDK and one for agent/MCP consumers.
- Start with environment discovery + read-only capability/quote success.
- Make the first tr

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/886) · 2026-08-21 · open · 0 comments

### P1: generate endpoint-level auth scope and permission manifest

Parent: #872

## Benchmark property
Supabase and Cloudflare make required scopes/roles discoverable at endpoint level. Cloudflare's current 403 responses link directly to the denied endpoint documentation and permission requirements.

## Verified Suwappu foundation
- Organization API keys have named scopes and `requireScope()` enforcement.
- Wildcard `*` exists.
- Agent bearer tokens have a separate capability model.
- This parity branch makes org-scope failures return `INSUFFICIENT_SCOPE`, `req

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/882) · 2026-08-21 · open · 0 comments

### P1: define webhook delivery contract and delivery explorer

Parent: #872

## Benchmark property
Alchemy publicly documents webhook HMAC verification, testing, automatic retry/backoff, retry windows and ordering behavior. Mature webhook platforms make duplicate/replay semantics explicit and provide delivery evidence/redrive tooling.

## Verified Suwappu foundation
- Agent callback/webhook concepts exist.
- Signed swap-state webhooks are documented on public agent material.
- `/webhooks/test` and webhook event/history surfaces exist in the Agent API.

## M

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/878) · 2026-08-21 · open · 0 comments

### P0: publish and enforce SDK/API compatibility lifecycle

Parent: #872

## Benchmark property
Cloudflare publishes an SDK support lifecycle, semver expectations, migration guidance and active-support rules. Mature infrastructure separates SDK package versions from API compatibility versions.

## Verified Suwappu state
- `@suwappu/sdk` source is 0.6.x and published releases can lag source.
- `@suwappu/mcp-server` has its own source/registry version boundary.
- Python SDK is source-only in the current Product Status contract.
- Agent REST has `/v1`; Open

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/876) · 2026-08-21 · open · 0 comments

### Telegram initData Validation Endpoint

## Summary
Add FastAPI endpoint to validate Telegram WebApp initData for secure authentication.

## Dependencies
- **Blocks**: #10 (API client needs validation endpoint)
- **Parallel**: #6, #7, #8, #9 (frontend work can proceed simultaneously)

## Implementation
Add endpoint to validate Telegram WebApp data:
- POST /webapp/validate
- Verify HMAC signature using bot token
- Return user info if valid
- 401 if invalid

## Files to Create/Modify
- `api/webapp.py` - New router for webapp endpoints
- 

[Read the thread](https://github.com/0xSoftBoi/suwappubot/issues/11) · 2026-01-17 · closed · 0 comments

The remaining reports are on [the project's issue tracker](https://github.com/0xSoftBoi/suwappubot/issues).