Head to head
Compare two models
Same 29 PRs, same goldens — which bugs did one find that the other missed?
53both found
2only MiniMax M3
6only Qwen3.8 27B
32neither found
Per-PR diff (29)
Keycloak · Javaadd-caching-support-for-identityproviderstorageprovider-getforlogin-operations-keycloak1 disagree · 2 goldens
CriticalRecursive caching call using session instead of delegateMiniMax M3 found it · Qwen3.8 27B missed it
MediumCleanup reference uses incorrect alias - should be 'idp-alias-' + i instead of 'alias'.MiniMax M3 missed it · Qwen3.8 27B missed it
Keycloak · Javaadd-client-resource-type-and-scopes-to-authorization-schema-keycloakagree · 3 goldens
HighInconsistent feature flag bug causing orphaned permissions. The AdminPermissions event listener, responsible for cleaning up permissions upon role, client, or group removal, is incorrectly guarded by the ADMIN_FINE_GRAINED_AUTHZ (V1) feature flag. This is inconsistent with other methods in the class that use ADMIN_FINE_GRAINED_AUTHZ_V2. Consequently, if ADMIN_FINE_GRAINED_AUTHZ_V2 is enabled but V1 is not, the permission cleanup logic will not execute, leading to orphaned permission data. Cleanup should occur regardless of which fine-grained authorization version is enabled.MiniMax M3 found it · Qwen3.8 27B found it
HighIn hasPermission(ClientModel client, String scope), the resource lookup uses findByName(server, client.getId(), server.getId()), but AdminPermissionsSchema.getOrCreateResource creates per-client resources with the owner set to resourceServer.getClientId(), so this lookup will never find those resources and will always fall back to the 'all-clients' resource, effectively ignoring client-specific permissions.MiniMax M3 found it · Qwen3.8 27B found it
HighIn getClientsWithPermission(String scope), iterating resourceStore.findByType(server, AdminPermissionsSchema.CLIENTS_RESOURCE_TYPE) and returning resource.getName() will only ever consider the type-level 'Clients' resource (per-client resources have no type) and return its name, while AvailableRoleMappingResource#getRoleIdsWithPermissions expects actual client IDs to pass to realm.getClientById, which can lead to incorrect behavior or a null client and subsequent failures.MiniMax M3 found it · Qwen3.8 27B found it
cal.com · TypeScriptadd-guest-management-functionality-to-existing-bookings-cal-com2 disagree · 5 goldens
HighCase sensitivity bypass in email blacklistMiniMax M3 missed it · Qwen3.8 27B found it
CriticalThe logic for checking team admin/owner permissions is incorrect. This condition uses AND (&&) which requires both isTeamAdmin AND isTeamOwner to be true, but it should use OR (||) since a user needs to be either an admin OR an owner to have permission.MiniMax M3 found it · Qwen3.8 27B found it
MediumThis calls the email sender with the original guests, so existing attendees included in the input will be treated as new when sending notifications, leading to incorrect emails.MiniMax M3 missed it · Qwen3.8 27B found it
MediumuniqueGuests filters out existing attendees and blacklisted emails but does not deduplicate duplicates within the input; createMany can insert duplicate attendee rows if the client submits repeated emails.MiniMax M3 found it · Qwen3.8 27B found it
LowStarting with an array containing an empty string may cause validation issues. Consider starting with an empty array [] and handling the empty state in the MultiEmail component instead.MiniMax M3 missed it · Qwen3.8 27B missed it
Keycloak · Javaadd-html-sanitizer-for-translated-message-resources-keycloakagree · 4 goldens
MediumThe translation is in Italian instead of Lithuanian. This should be translated to Lithuanian to match the file's locale (messages_lt.properties).MiniMax M3 missed it · Qwen3.8 27B missed it
MediumThe totpStep1 value uses Traditional Chinese terms in the Simplified Chinese file (zh_CN), which is likely incorrect for this locale. Please verify the locale‑appropriate translation.MiniMax M3 missed it · Qwen3.8 27B missed it
LowThe anchor sanitization logic has a potential issue where it consumes English matcher groups without proper validation. If the translated text has more anchor tags than the English text, this could lead to incorrect validation results.MiniMax M3 found it · Qwen3.8 27B found it
LowThe method name 'santizeAnchors' should be 'sanitizeAnchors' (missing 'i').MiniMax M3 missed it · Qwen3.8 27B missed it
Grafana · Goanonymous-add-configurable-device-limit-grafana-codex1 disagree · 5 goldens
HighRace condition: Multiple concurrent requests could pass the device count check simultaneously and create devices beyond the limit. Consider using a database transaction or lock.MiniMax M3 found it · Qwen3.8 27B found it
MediumAnonymous authentication now fails entirely if anonDeviceService.TagDevice returns ErrDeviceLimitReached. Previously, device tagging was asynchronous and non-blocking. This change prevents anonymous users from authenticating when the device limit is reached.MiniMax M3 found it · Qwen3.8 27B found it
MediumThis call won’t compile: dbSession.Exec(args...) is given a []interface{} where the first element is the query, but Exec’s signature requires a first parameter of type string (not an interface{} splat).MiniMax M3 found it · Qwen3.8 27B found it
LowReturning ErrDeviceLimitReached when no rows were updated is misleading; the device might not exist.MiniMax M3 missed it · Qwen3.8 27B found it
LowTime window calculation inconsistency: Using device.UpdatedAt.UTC().Add(-anonymousDeviceExpiration) as the lower bound but device.UpdatedAt as the current time may not match the intended logic. Consider using time.Now().UTC() consistently.MiniMax M3 found it · Qwen3.8 27B found it
Grafana · Godual-storage-architecture-grafana-codexagree · 3 goldens
MediumThe context is being created with d.Log instead of the log variable that was initialized with additional context values (name, kind, method). This means those values won't be propagated to the logging context.MiniMax M3 found it · Qwen3.8 27B found it
HighBug: calling recordLegacyDuration when storage operation fails should be recordStorageDuration.MiniMax M3 found it · Qwen3.8 27B found it
MediumInconsistency: using name instead of options.Kind for metrics recording differs from other methods.MiniMax M3 found it · Qwen3.8 27B found it
Discourse · Rubyenhance-embed-url-handling-and-validation-system-discourse-cursoragree · 6 goldens
CriticalSSRF vulnerability using open(url) without validationMiniMax M3 missed it · Qwen3.8 27B missed it
MediumThe current origin validation using indexOf is insufficient and can be bypassed. An attacker could use a malicious domain like evil-discourseUrl.com to pass this check.MiniMax M3 missed it · Qwen3.8 27B missed it
MediumpostMessage targetOrigin should be the origin (scheme+host+port), not the full referrer URL; using the full URL will cause the message to be dropped and prevent resizing.MiniMax M3 missed it · Qwen3.8 27B missed it
MediumThe code sets X-Frame-Options: ALLOWALL which completely disables clickjacking protection. The referer validation can be bypassed (referer headers are easily spoofed), and the fallback to empty string for nil referer masks validation failures.MiniMax M3 found it · Qwen3.8 27B found it
MediumThe TopicEmbed.import method is susceptible to a NoMethodError if the contents parameter is nil when attempting to append a string, and an XSS vulnerability due to unescaped url interpolation in the generated HTML.MiniMax M3 found it · Qwen3.8 27B found it
MediumThe ERB block closes with end if, which is invalid Ruby/ERB and will raise at render; it should just be end to close the if block.MiniMax M3 missed it · Qwen3.8 27B missed it
cal.com · TypeScriptfeat-2fa-backup-codes-cal-comagree · 4 goldens
LowThe exported function TwoFactor handles backup codes and is in BackupCode.tsx. Inconsistent naming.MiniMax M3 missed it · Qwen3.8 27B missed it
LowError message mentions 'backup code login' but this is a disable endpoint, not loginMiniMax M3 missed it · Qwen3.8 27B missed it
MediumBackup code validation is case-sensitive due to the use of indexOf(). This causes validation to fail if a user enters uppercase hex characters, as backup codes should be case-insensitive for a better user experience.MiniMax M3 found it · Qwen3.8 27B found it
HighBecause backupCodes are decrypted and mutated in memory before being written back, two concurrent login requests using the same backupCode could both pass this check and update, so a single backup code may effectively be accepted more than once if used concurrently, weakening the intended one-time-use semantics.MiniMax M3 found it · Qwen3.8 27B found it
cal.com · TypeScriptfeat-convert-insightsbookingservice-to-use-prisma-sql-raw-queries-cal-comagree · 2 goldens
LowIn getBaseConditions(), the else if (filterConditions) and final else branches are unreachable. This is because getAuthorizationConditions() always returns a non-null Prisma.Sql object, making authConditions always truthy, which means only the first two if/else if conditions are ever evaluated.MiniMax M3 found it · Qwen3.8 27B found it
MediumFetching userIdsFromOrg only when teamsFromOrg.length > 0 can exclude org-level members for orgs without child teams; consider deriving from teamIds (which includes orgId) or removing the guard so org-only orgs still include member user bookings.MiniMax M3 found it · Qwen3.8 27B found it
Sentry · Pythonfeat-ecosystem-implement-cross-system-issue-synchronization-sentryagree · 4 goldens
MediumShared mutable default in dataclass timestampMiniMax M3 found it · Qwen3.8 27B found it
LowThe method name has a typo: test_from_dict_inalid_data should be test_from_dict_invalid_data.MiniMax M3 missed it · Qwen3.8 27B missed it
LowMethod name says 'empty_array' but tests empty dict - consider renaming to 'test_from_dict_empty_dict' for clarity.MiniMax M3 missed it · Qwen3.8 27B missed it
Mediumto_dict() returns a datetime for queued; if this dict is passed in task kwargs (e.g., via apply_async), JSON serialization may fail depending on the serializer, which can cause enqueue errors.MiniMax M3 missed it · Qwen3.8 27B missed it
Sentry · Pythonfeat-workflow-engine-add-in-hook-for-producing-occurrences-from-the-stateful-det-sentryagree · 2 goldens
HighMetricAlertDetectorHandler inherits from StatefulDetectorHandler but only contains pass, failing to implement its required abstract methods: counter_names (property), get_dedupe_value(), get_group_key_values(), and build_occurrence_and_event_data(). This will cause a TypeError at runtime when the class is instantiated.MiniMax M3 found it · Qwen3.8 27B found it
LowDocstring says this returns a list of DetectorEvaluationResult, but the method now returns a dict keyed by DetectorGroupKey. Consider updating the docstring to match the new return type.MiniMax M3 missed it · Qwen3.8 27B missed it
Discourse · Rubyfeature-automatically-downsize-large-images-discourse-cursoragree · 3 goldens
MediumThe downsize method is defined twice. The second definition, which expects a single dimensions string parameter, overrides the first, which expected separate max_width and max_height parameters. This makes the original method unreachable and breaks existing code that calls it with separate width and height arguments.MiniMax M3 found it · Qwen3.8 27B found it
LowHardcoding maxSizeKB = 10 * 1024 ignores Discourse.SiteSettings['max_' + type + '_size_kb'], so the client-side limit can diverge from server-side and per-type settings (also applies to the 413 handler below).MiniMax M3 found it · Qwen3.8 27B found it
MediumPassing 80% as the dimensions can fail for animated GIFs when allow_animated_thumbnails is true, since the animated path uses gifsicle --resize-fit which expects WxH geometry, not a percentage; downsizing would then silently fail.MiniMax M3 found it · Qwen3.8 27B found it
Discourse · Rubyfeature-can-edit-category-host-relationships-for-embedding-discourse-cursoragree · 4 goldens
CriticalNoMethodError before_validation in EmbeddableHostMiniMax M3 found it · Qwen3.8 27B found it
MediumThe update and destroy methods in Admin::EmbeddableHostsController do not validate the existence of the EmbeddableHost record retrieved by ID. If EmbeddableHost.where(id: params[:id]).first returns nil (i.e., the host does not exist), attempting to call methods on the nil object (e.g., save_host or destroy) will result in a NoMethodError.MiniMax M3 found it · Qwen3.8 27B found it
Mediumrecord_for_host compares lower(host) = ? but does not normalize the parameter’s case, so mixed‑case referer hosts may fail to match even though comparison intends to be case‑insensitive.MiniMax M3 missed it · Qwen3.8 27B missed it
HighBecause this migration inserts embeddable_hosts rows with raw SQL, any existing embeddable_hosts values that include http:// or /https:// or path segments won’t go through the EmbeddableHost model’s normalization, so the new host lookup (which compares only the bare host) may fail for migrated data. Consider ensuring that migrated hosts are normalized to the same format as newly created EmbeddableHost records so existing embedding configurations keep working.MiniMax M3 found it · Qwen3.8 27B found it
Keycloak · Javafix-concurrent-group-access-to-prevent-nullpointerexception-keycloakagree · 2 goldens
CriticalReturning null from getSubGroupsCount() violates the GroupModel contract (Javadoc says it never returns null) and may lead to NPEs in callers that expect a non-null count.MiniMax M3 missed it · Qwen3.8 27B missed it
MediumThe reader thread isn’t waited for; flipping deletedAll to true and asserting immediately can race and miss exceptions added just after the flag change, making this test flaky.MiniMax M3 missed it · Qwen3.8 27B missed it
cal.com · TypeScriptfix-handle-collective-multiple-host-on-destinationcalendar-cal-com1 disagree · 5 goldens
HighPotential null reference if mainHostDestinationCalendar is undefined if evt.destinationCalendar is null or an empty array MiniMax M3 missed it · Qwen3.8 27B found it
LowThe optional chaining on mainHostDestinationCalendar?.integration is redundant since you already check mainHostDestinationCalendar in the ternary condition.MiniMax M3 missed it · Qwen3.8 27B missed it
HighLogic error: when externalCalendarId is provided, you're searching for a calendar where externalId === externalCalendarId, but this will always fail since you're looking for a calendar that matches itself. Should likely find by credentialId or use different logic.MiniMax M3 found it · Qwen3.8 27B found it
MediumLogic inversion in organization creation: The slug property is now conditionally set when IS_TEAM_BILLING_ENABLED is true, instead of when it's false as originally intended. This change, combined with requestedSlug still being set when IS_TEAM_BILLING_ENABLED is true, results in both properties being set when billing is enabled, and neither when disabledMiniMax M3 found it · Qwen3.8 27B found it
LowThe Calendar interface now requires createEvent(event, credentialId), but some implementations (e.g., Lark/Office365) still declare createEvent(event) only—this breaks the interface contract (also applies to other locations in the PR).MiniMax M3 found it · Qwen3.8 27B found it
Discourse · Rubyfix-proper-handling-of-group-memberships-discourse-cursoragree · 3 goldens
High The findMembers() call is now asynchronous and unhandled. The controller may not have member data immediately available, creating a race condition.MiniMax M3 missed it · Qwen3.8 27B missed it
MediumIn the next action, capping the next offset at user_count can produce an empty page (e.g., total equal to limit results in offset == total, showing 2/2 with no members). This can cause confusing UX on the last page.MiniMax M3 found it · Qwen3.8 27B found it
MediumHTTP method mismatch in .remove_member - test uses PUT but remove_member action expects DELETEMiniMax M3 missed it · Qwen3.8 27B missed it
Keycloak · Javafixing-re-authentication-with-passkeys-keycloakagree · 2 goldens
MediumConditionalPasskeysEnabled() called without UserModel parameterMiniMax M3 missed it · Qwen3.8 27B missed it
MediumWith isConditionalPasskeysEnabled(UserModel user) requiring user != null, authenticate(...) will not call webauthnAuth.fillContextForm(context) on the initial login page where context.getUser() is still null, so conditional passkey UI will not be set up for first-time passkey login. Consider whether this should also be enabled when no user has been selected yet so ID-less passkey authentication on the initial login form continues to work.MiniMax M3 found it · Qwen3.8 27B found it
Grafana · Gofrontend-asset-optimization-grafana-codexagree · 2 goldens
MediumThe GetWebAssets function implements an incomplete double-checked locking pattern for caching web assets. The function first checks if the cache is populated using a read lock (RLock), and if the cache is empty, it acquires a write lock to populate it. However, it fails to re-check whether the cache was populated by another goroutine while waiting to acquire the write lock.MiniMax M3 found it · Qwen3.8 27B found it
HighIn addition to the missing double-check, the function has a critical flaw in its error handling: it unconditionally assigns the fetch result to the cache (line 69: entryPointAssetsCache = result) regardless of whether the fetch succeeded or failed. When an error occurs during asset fetching, result is nil, and this nil value overwrites any previously valid cache entry.MiniMax M3 found it · Qwen3.8 27B found it
Sentry · Pythongithub-oauth-security-enhancement-sentryagree · 3 goldens
MediumNull reference if github_authenticated_user state is missingMiniMax M3 missed it · Qwen3.8 27B missed it
MediumOAuth state uses pipeline.signature (static) instead of a per-request random valueMiniMax M3 missed it · Qwen3.8 27B missed it
HighThe code attempts to access integration.metadata[sender][login] without checking for the existence of the sender key. This causes a KeyError for integrations where the sender metadata was not set during creationMiniMax M3 found it · Qwen3.8 27B found it
Keycloak · Javaimplement-access-token-context-encoding-framework-keycloakagree · 4 goldens
CriticalWrong parameter in null check (grantType vs. rawTokenId)MiniMax M3 found it · Qwen3.8 27B found it
HighIn isAccessTokenId, the substring for the grant shortcut and the equality check look inverted: the grant shortcut occupies indices 4–5 (substring(4,6)), and a match should return true (combined with UUID check), not false.MiniMax M3 found it · Qwen3.8 27B found it
LowJavadoc mentions "usually like 3-letters shortcut" but some implementations use 2-letter shortcuts ("ac", "cc", "rt", "te", "pc", "ci", "ro"). Consider updating documentation to reflect actual usage pattern.MiniMax M3 found it · Qwen3.8 27B found it
Low Catching generic RuntimeException is too broad. The implementation throws IllegalArgumentException specifically - catch that instead for more precise testing.MiniMax M3 missed it · Qwen3.8 27B missed it
Grafana · Gonotification-rule-processing-engine-grafana-codexagree · 2 goldens
MediumThe rendered GrafanaRuleListItem is missing the required key prop for React list items. This can cause rendering issues when the list order changes.MiniMax M3 missed it · Qwen3.8 27B missed it
HighRuleActionsButtons is invoked with only promRule, but SilenceGrafanaRuleDrawer inside RuleActionsButtons still depends on a Grafana Ruler rule being present, so for Grafana rules coming from list views the 'Silence notifications' menu entry (now driven by Grafana Prom abilities) will toggle showSilenceDrawer without ever rendering the drawer. This means clicking 'Silence notifications' for these rules has no visible effect, even when abilities indicate silencing is allowed.MiniMax M3 found it · Qwen3.8 27B found it
cal.com · TypeScriptoauth-credential-sync-and-app-integration-enhancements-cal-com1 disagree · 5 goldens
HighThe parseRefreshTokenResponse function incorrectly sets refresh_token to the hardcoded string 'refresh_token' when it's missing from the OAuth refresh token response. This invalidates the token, breaking subsequent token refreshes and causing authentication failures.MiniMax M3 found it · Qwen3.8 27B found it
HighInvalid Zod schema syntax. Computed property keys like [z.string().toString()] are not valid in Zod object schemas and will cause runtime errors. MiniMax M3 missed it · Qwen3.8 27B found it
HighparseRefreshTokenResponse returns a Zod safeParse result ({ success, data, error }), not the credential key object. Persisting that as key stores the wrapper instead of the token payload; we should store the parsed data or use schema parse.MiniMax M3 found it · Qwen3.8 27B found it
HighWhen APP_CREDENTIAL_SHARING_ENABLED and CALCOM_CREDENTIAL_SYNC_ENDPOINT are set, the refreshFunction helper returns the fetch Response, but several callers (for example GoogleCalendarService.refreshAccessToken expecting res.data, and HubspotCalendarService.refreshAccessToken expecting a HubspotToken) assume it returns the integration-specific token object. That mismatch will cause runtime errors in the sync-enabled path unless the return type or those call sites are adjusted.MiniMax M3 found it · Qwen3.8 27B found it
HighWhen the sync endpoint path is used, res is a fetch Response and has no .data; res?.data will be undefined and token.access_token will throw at runtime. This relies on a consistent return shape from refreshOAuthTokens, which isn’t guaranteed currently.MiniMax M3 found it · Qwen3.8 27B found it
Discourse · Rubyoptimize-header-layout-performance-with-flexbox-mixins-discourse-cursor1 disagree · 2 goldens
LowMixing float: left with flexbox causes layout issues. Further this PR removes the float-based right alignment for .d-header .panel, which may cause the login panel in the non-Ember/noscript header (where .panel is nested inside .row and not a flex item) to stack under the title instead of remaining right-aligned.MiniMax M3 found it · Qwen3.8 27B found it
Low-ms-align-items never existed in any version of IE/Edge; the correct legacy property is -ms-flex-align.MiniMax M3 found it · Qwen3.8 27B missed it
Grafana · Goplugins-chore-renamed-instrumentation-middleware-to-metrics-middleware-grafana-codexagree · 2 goldens
HighThe ContextualLoggerMiddleware methods (QueryData, CallResource, CheckHealth, CollectMetrics) panic when a nil request is received. This occurs because they directly access req.PluginContext (via the instrumentContext function) without first checking if req is nil. This is a regression, as previous middleware layers gracefully handled nil requests.MiniMax M3 found it · Qwen3.8 27B found it
LowThe traceID is no longer logged for plugin requests. During a refactoring, the tracing import and the logic to extract and add traceID from the context to log parameters were removed from the LoggerMiddleware. The newly introduced ContextualLoggerMiddleware does not add this information, resulting in missing traceID in plugin request logs and impacting debugging and request tracing capabilities.MiniMax M3 found it · Qwen3.8 27B found it
Sentry · Pythonreplays-self-serve-bulk-delete-system-sentry1 disagree · 3 goldens
MediumBreaking changes in error response formatMiniMax M3 missed it · Qwen3.8 27B found it
MediumDetector validator uses wrong key when updating typeMiniMax M3 missed it · Qwen3.8 27B missed it
LowUsing zip(error_ids, events.values()) assumes the get_multi result preserves the input order; dict value order is not guaranteed to match error_ids, so event data can be paired with the wrong ID (missing nodes also shift alignment).MiniMax M3 found it · Qwen3.8 27B found it
Sentry · Pythonref-crons-reorganize-incident-creation-issue-occurrence-logic-sentryagree · 2 goldens
HighThe function modifies the config variable to include display values but then returns the original monitor.config instead of the modified version.MiniMax M3 missed it · Qwen3.8 27B missed it
LowThe code fetches MonitorCheckIn objects by ID when the required data already exists in previous_checkins. This creates an unnecessary database query.MiniMax M3 missed it · Qwen3.8 27B missed it
cal.com · TypeScriptsms-workflow-reminder-retry-count-tracking-cal-comagree · 2 goldens
HighUsing retryCount: reminder.retryCount + 1 reads a possibly stale value and can lose increments under concurrency; consider an atomic increment via Prisma (increment: 1) to avoid race conditions (also applies to the similar update in the catch block).MiniMax M3 found it · Qwen3.8 27B found it
HighThe deletion logic in scheduleSMSReminders.ts incorrectly deletes non-SMS workflow reminders (e.g., Email, WhatsApp) that have retryCount > 1. This occurs because the retryCount condition within the OR clause for deletion lacks a method: WorkflowMethods.SMS filter, causing it to apply to all reminder types instead of only SMS reminders, which is the intended scope of this function.MiniMax M3 found it · Qwen3.8 27B found it
Sentry · Pythonspan-buffer-multiprocess-enhancement-with-health-monitoring-sentryagree · 5 goldens
MediumInconsistent metric tagging with 'shard' and 'shards'MiniMax M3 missed it · Qwen3.8 27B missed it
LowFixed sleep in tests can be flaky; wait on condition insteadMiniMax M3 missed it · Qwen3.8 27B missed it
HighBecause flusher processes are created via multiprocessing.get_context('spawn').Process, they are instances of multiprocessing.context.SpawnProcess, which on POSIX is not a subclass of multiprocessing.Process, so this isinstance check will always be false and hung processes won't be killed here.MiniMax M3 found it · Qwen3.8 27B found it
MediumSleep in test_consumer.py won’t actually wait because time.sleep was monkeypatched above; consider restoring sleep or using a different sync to ensure the flusher has time to process.MiniMax M3 missed it · Qwen3.8 27B missed it
MediumBreaking out of the loop when the deadline has elapsed can skip terminating remaining flusher processes, potentially leaving them running after shutdown; consider ensuring termination is attempted even if the deadline is exceeded.MiniMax M3 found it · Qwen3.8 27B found it
Grafana · Gounified-storage-performance-optimizations-grafana-codexagree · 2 goldens
HighA race condition in BuildIndex allows multiple goroutines to concurrently build the same expensive index for the same key. This is caused by moving the b.cacheMu lock from protecting the entire function to only protecting the final cache assignment. MiniMax M3 found it · Qwen3.8 27B found it
HighCalling s.search.TotalDocs() here may race with concurrent index creation: TotalDocs iterates b.cache without synchronization, and the event watcher goroutine started just above could trigger BuildIndex writes concurrently, potentially causing a concurrent map read/write panic.MiniMax M3 found it · Qwen3.8 27B found it