Porting the Python backend (back/) to Rust (back-rs/, branch feat/rust-backend) meant reading every route,
use case and repository closely, and running both backends side by side on the same database. Along the way this
turned up defects in the Python code. Some are security holes. Some are bugs that make endpoints fail on every
call. Some are robustness gaps.
Every finding below was checked again against the Python source as it stood on 2026-10-17. The last commit
touching back/ at that point was e9b6b0e37 (2026-10-13). Line numbers refer to that tree.