Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 65-84: The format-check job must be hardened: in the job
"format-check" replace unpinned actions (uses: actions/checkout@v4 and uses:
actions/setup-node@v4) with their pinned commit SHAs, add persist-credentials:
false under the Checkout code step, add a narrow permissions block at the job
level (e.g., permissions: contents: read) to restrict token scope, and change
the Install root dependencies step to use npm ci instead of npm install to match
other jobs and provide a reproducible clean install; apply these edits to the
steps named "Checkout code", "Set up Node.js", and "Install root dependencies"
respectively.

In `@backend/src/services/campaignController.ts`:
- Around line 11-13: Update the 400 error message to match the actual accepted
sort key names defined in VALID_SORT_FIELDS: replace "createdTime" with
"createdAt" in the JSON error response returned (the block that does return
res.status(400).json(...)). Ensure the message lists the exact keys from
VALID_SORT_FIELDS (createdAt, deadline, pledgedAmount, percentFunded) so clients
get the correct guidance.

In `@backend/test-results/.last-run.json`:
- Around line 1-4: Remove the committed volatile test-run artifact
.last-run.json from version control and stop tracking it, then add a rule to
ignore such ephemeral test state (e.g., add a pattern for .last-run.json or the
test-results directory) to .gitignore so it won’t be re-added; also ensure any
CI/build scripts don’t accidentally commit this file and remove it from the
current commit history/index (unstage/remove from repo) so future PRs aren’t
noisy.

In `@backend/tests/integration_test.ts`:
- Around line 348-365: The test sets a future deadline so the campaign remains
open; change the campaign creation in the failing test (call to
createTestCampaign) to use a past deadline (e.g., deadline: nowInSeconds() - 50
or nowInSeconds() - 1) so the campaign transitions to 'failed' immediately;
update the createTestCampaign invocation in backend/tests/integration_test.ts
(the test that uses nowInSeconds()) and keep the subsequent calls to
addTestPledge, getCampaignDetails and the assertions unchanged.
- Around line 67-77: The default test campaign fixture in createTestCampaign()
uses a description shorter than the backend minimum (20 chars); update the
default description string to meet the validation (e.g., make it >=20
characters) so tests using the fixture pass, keeping the function signature and
spread of overrides intact (ensure CREATOR_1, title, assetCode, targetAmount,
deadline and ...overrides remain unchanged).
- Around line 97-105: The default transactionHash produced by claimTestCampaign
is not a 64-character hex string required by backend validation; update
claimTestCampaign to supply a valid 64-char hex when txHash is omitted by
generating a 32-byte hex string (e.g. via Node's
crypto.randomBytes(32).toString('hex')) or by adding a helper like
generateValidTxHash() and using it as the fallback for transactionHash; ensure
you import/require crypto (or add the helper) and replace the current 'tx_' +
generateTestId('claim') fallback with the 64-char hex generator.
- Around line 570-572: The loop uses invalid contributor IDs like
`CONTRIBUTOR_${i}` so addTestPledge(campaignId, ...) fails validation; replace
those placeholders with real Stellar account IDs used in tests (e.g., generate
or obtain test keypairs and use their publicKey values or use existing test
fixture accounts) before calling addTestPledge, or call the helper that
creates/funds test accounts (e.g., createTestAccount/createFundedAccount) and
pass the returned account.publicKey; ensure the loop iterates over those valid
public keys so pledges succeed.

In `@DEPLOYMENT.md`:
- Line 78: The DB_PATH example is inconsistent with the Render Root Directory
being set to "backend"; update the example environment variable so it is
relative to that root (replace DB_PATH=backend/data/campaigns.db with
DB_PATH=data/campaigns.db) and apply the same fix for any other occurrences of
the redundant "backend/" prefix in the DEPLOYMENT.md examples or env snippets to
avoid creating nested backend/backend paths.

In `@frontend/src/App.tsx`:
- Around line 258-275: The early return when visualTestMode === 'campaign-card'
breaks React hook ordering; instead ensure all hooks in App.tsx run
unconditionally (so keep useState/useEffect/etc. at top) and only conditionally
render the visual test UI afterwards—e.g., run the hooks that define
visualCampaigns and visualSelectedCampaignId (and any other hooks) first, then
if visualTestMode === 'campaign-card' return or render the CampaignCard grid;
reference visualTestMode, visualCampaigns, visualSelectedCampaignId,
setVisualSelectedCampaignId and CampaignCard to locate and move the conditional
rendering below the hook calls or into a JSX branch so hook order is preserved.

In `@frontend/src/components/CampaignsTable.integration.test.tsx`:
- Around line 75-77: The teardown in CampaignsTable.integration.test.tsx only
calls vi.restoreAllMocks() but does not revert timers set by beforeEach's
vi.useFakeTimers(); add a call to vi.useRealTimers() (or
vi.runOnlyPendingTimers() then vi.useRealTimers() if needed) in the afterEach
block to ensure fake timers are restored to real timers and avoid cross-test
leakage; update the afterEach that currently references vi.restoreAllMocks() to
also invoke vi.useRealTimers(), targeting the same test file's
beforeEach/afterEach pair.

In `@frontend/src/components/CampaignsTable.tsx`:
- Line 2: The CampaignsTable component imports hooks but omits useEffect, which
is referenced in the component and causes a runtime error; update the import
line that currently reads "import { useMemo, useState } from 'react';" to also
include useEffect so the component (CampaignsTable) can call useEffect without
failing.

In `@frontend/src/components/CreateCampaignForm.test.tsx`:
- Around line 132-147: The "empty title" test in CreateCampaignForm.test.tsx
currently types 'My Test Campaign' into the title field (using the placeholder
/Stellar community design sprint/i), which invalidates the assertion expecting
'Campaign title is required'; to fix, update the test to leave the title empty
(remove the user.type call that fills the title) or explicitly clear the title
before submitting (e.g., target the same placeholder text and clear it) so that
when clicking the create button the form validation produces 'Campaign title is
required' as asserted.

In `@frontend/src/components/SearchInput.test.tsx`:
- Line 81: The test queries use getByPlaceholderText with the wrong placeholder
string ('Search campaigns..' two dots) causing mismatch with the expected
component placeholder ('Search campaigns...' three dots); update all
getByPlaceholderText calls that pass 'Search campaigns..' (e.g., the calls
assigning to the variable input and other similar queries) to use 'Search
campaigns...' so they match the component's actual placeholder text.

---

Outside diff comments:
In @.github/workflows/playwright-visual-regression.yml:
- Around line 1-42: Replace unpinned GitHub actions with commit SHA pins for
actions/checkout, actions/setup-node and actions/upload-artifact (do not rely on
tag refs like actions/checkout@v4), add persist-credentials: false to the
checkout step (symbol: persist-credentials), add a minimal permissions block
(e.g., permissions: contents: read with any other granular perms required by the
job) to the workflow header (symbol: permissions), and change the dependency
install step to use npm ci instead of npm install (symbol: npm ci) to ensure
reproducible installs.

In `@backend/src/index.ts`:
- Around line 624-626: The current CommonJS guard using require.main causes a
ReferenceError under ESM; replace it with an ESM-safe "main module" check that
uses the existing __filename (and path if needed) to detect invocation and call
startServer() only when the script is the entrypoint—e.g. compare
process.argv[1] to __filename (or compare import.meta.url to the file URL built
from __filename) and invoke startServer() when they match so the check does not
rely on require or throw under ts-node --esm.

---

Nitpick comments:
In `@frontend/package.json`:
- Around line 17-18: Package.json lists "react": "^18.2.0" while "react-dom":
"^18.3.1"; update the semver ranges so they match the installed lockfile version
to prevent drift—for example change the "react" entry to "^18.3.1" (so both
"react" and "react-dom" use "^18.3.1") and save package.json; this keeps the
dependencies aligned with the package-lock resolution.

In `@frontend/src/components/campaignsTableUtils.ts`:
- Around line 57-67: The applyFilters function accepts a searchQuery parameter
but never uses it; remove the unused searchQuery parameter and any related
JSDoc/comment that claims search is handled here, update the applyFilters
signature (remove searchQuery: string = '') and its type annotations, and update
all callers to stop passing a searchQuery argument so the call sites match the
new signature; keep the existing client-side filtering logic (assetCode/status)
in applyFilters and ensure any server-side search behavior remains in the code
that performs server queries.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 48-53: Replace the tag-based action reference in the "Upload
backend audit artifact" step with a pinned commit SHA: change uses:
actions/upload-artifact@v4 to uses: actions/upload-artifact@<commit-sha> (use
the specific commit SHA from the actions/upload-artifact repository) and apply
the same pinning to other occurrences of actions/upload-artifact@v4 in the repo
(e.g., in the steps named similarly in playwright-visual-regression.yml,
frontend.yml, contracts-ci.yml, and playwright-e2e.yml) so the upload-artifact
action is referenced immutably.

In `@backend/src/index.ts`:
- Around line 84-97: The file references compression, apiKeyAuthMiddleware,
cacheMiddleware, and initRedisCache but never imports them; add top-level import
statements in backend/src/index.ts to pull compression from the compression
package and the apiKeyAuthMiddleware, cacheMiddleware, and initRedisCache from
your middleware/cache module (the same module that defines your cache and auth
utilities) so the app.use(...) calls (and the later references around lines
~658-665) compile correctly.
- Around line 294-300: The call to calculateProgress in the campaigns mapping
uses an outdated third argument (pledgeCounts[campaign.id]); update the call
site to the new signature by removing the third parameter so it reads
calculateProgress(campaign, undefined) (or just calculateProgress(campaign) if
appropriate), leaving the surrounding listCampaigns, campaigns, pledgeCounts,
and filterCampaignList usage unchanged; if pledgeCounts were intended to
influence progress, move that logic into calculateProgress or compute a derived
value before calling calculateProgress and pass it via the second optional "at"
parameter as needed.

In `@frontend/src/App.tsx`:
- Around line 256-265: The code uses SCROLL_KEY inside the useEffect (and also
at lines ~648-652) but SCROLL_KEY is not declared, causing a compile error and
broken scroll restore; define a single shared constant named SCROLL_KEY (for
example: const SCROLL_KEY = 'campaign-scroll-position') near the top of this
module or import it from your shared constants file, then replace any string
literals or missing references so both the useEffect that reads
sessionStorage.getItem(SCROLL_KEY) and the code that writes
sessionStorage.setItem(SCROLL_KEY, ...) use the same SCROLL_KEY symbol (ensure
the declaration is exported/imported if used across files).

In `@frontend/src/components/CampaignsTable.tsx`:
- Around line 101-107: The component uses useMediaQuery and useWindowVirtualizer
but never imports them; add the missing imports at the top of the file so the
component compiles. Specifically, import useMediaQuery (e.g., from `@mui/material`
or your project's UI lib) and import useWindowVirtualizer from the
virtualization library you use (e.g., `@tanstack/react-virtual`), then ensure the
symbols used in CampaignsTable (useMediaQuery and useWindowVirtualizer) refer to
those imports.

---

Outside diff comments:
In `@backend/src/index.ts`:
- Around line 561-628: The error middleware is broken by duplicated/stray code
and an incorrectly closed handler; replace the two fragments with one proper
Express error-handling middleware using the four-argument signature (err, req,
res, next) registered via app.use, keep the CORS branch for err.message === 'Not
allowed by CORS' inside that function, then compute statusCode and code (using
AppError), build the ApiErrorResponse (using RequestWithId for requestId), call
logError with the same metadata, and finally send
res.status(statusCode).json(response); remove the duplicated blocks and the
stray closing tokens so the handler is a single coherent function using app.use,
AppError, ApiErrorResponse, RequestWithId, and logError.

In `@backend/src/services/campaignStore.ts`:
- Around line 370-395: The data query is not using the same WHERE applied to
baseQuery so countQuery is filtered but dataQuery isn’t; update dataQuery to
build from the same baseQuery (or append the same whereClauses.join(' AND '))
rather than interpolating the stale whereClause variable, and fix parameter
handling so the data query uses a params copy with limit/offset (e.g., create
dataParams = params.slice(); if (paginate) dataParams.push(limit, offset)) while
leaving the original params for countQuery; adjust usage of
db.prepare(...).all(...) to pass dataParams for the SELECT rows and params for
the COUNT.

In `@frontend/src/App.tsx`:
- Line 1: The file is missing imports for hooks used elsewhere—add useRef to the
React import (alongside useEffect, useMemo, useState) and import useNavigate and
useParams from react-router-dom so references to useRef, useNavigate, and
useParams compile; update the top-level import lines in App.tsx to include these
symbols.
- Around line 461-468: The handlers are currently calling
refreshCampaigns(campaign.id) which mistakenly passes the campaign id into the
searchQuery parameter; change calls to pass the id as the nextSelectedId
argument instead of searchQuery (i.e., call refreshCampaigns with the search
query left as its default/empty value and campaign.id as the nextSelectedId).
Update handleCreate and the pledge/claim/refund call sites (the places that call
refreshCampaigns after create/pledge/claim/refund) to use the campaign id as
nextSelectedId so the UI refreshes normally and keeps that campaign selected.

In `@frontend/src/components/CampaignsTable.tsx`:
- Around line 301-434: The mobile JSX block is broken by leftover table elements
and duplicated card markup after the virtualization rewrite; fix the mobile
branch by removing stray table fragments (</td>, </tr>, the tbody/table
wrappers) and deleting the duplicate non-virtualized "cards-only" mapping so
only the virtualized mapping using virtualizer.getVirtualItems(), article
elements (with ref={virtualizer.measureElement}), and the existing usage of
filteredCampaigns, selectedCampaignId, onSelect, AddressAvatar, getStatusLabel,
and formatTimestamp remain; ensure each article is properly closed and there are
no duplicated card lists.

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/workflows/ci.yml:
- Around line 48-53: Replace the tag-based action reference in the "Upload
backend audit artifact" step with a pinned commit SHA: change uses:
actions/upload-artifact@v4 to uses: actions/upload-artifact@<commit-sha> (use
the specific commit SHA from the actions/upload-artifact repository) and apply
the same pinning to other occurrences of actions/upload-artifact@v4 in the repo
(e.g., in the steps named similarly in playwright-visual-regression.yml,
frontend.yml, contracts-ci.yml, and playwright-e2e.yml) so the upload-artifact
action is referenced immutably.

In `@backend/src/index.ts`:
- Around line 84-97: The file references compression, apiKeyAuthMiddleware,
cacheMiddleware, and initRedisCache but never imports them; add top-level import
statements in backend/src/index.ts to pull compression from the compression
package and the apiKeyAuthMiddleware, cacheMiddleware, and initRedisCache from
your middleware/cache module (the same module that defines your cache and auth
utilities) so the app.use(...) calls (and the later references around lines
~658-665) compile correctly.
- Around line 294-300: The call to calculateProgress in the campaigns mapping
uses an outdated third argument (pledgeCounts[campaign.id]); update the call
site to the new signature by removing the third parameter so it reads
calculateProgress(campaign, undefined) (or just calculateProgress(campaign) if
appropriate), leaving the surrounding listCampaigns, campaigns, pledgeCounts,
and filterCampaignList usage unchanged; if pledgeCounts were intended to
influence progress, move that logic into calculateProgress or compute a derived
value before calling calculateProgress and pass it via the second optional "at"
parameter as needed.

In `@frontend/src/App.tsx`:
- Around line 256-265: The code uses SCROLL_KEY inside the useEffect (and also
at lines ~648-652) but SCROLL_KEY is not declared, causing a compile error and
broken scroll restore; define a single shared constant named SCROLL_KEY (for
example: const SCROLL_KEY = 'campaign-scroll-position') near the top of this
module or import it from your shared constants file, then replace any string
literals or missing references so both the useEffect that reads
sessionStorage.getItem(SCROLL_KEY) and the code that writes
sessionStorage.setItem(SCROLL_KEY, ...) use the same SCROLL_KEY symbol (ensure
the declaration is exported/imported if used across files).

In `@frontend/src/components/CampaignsTable.tsx`:
- Around line 101-107: The component uses useMediaQuery and useWindowVirtualizer
but never imports them; add the missing imports at the top of the file so the
component compiles. Specifically, import useMediaQuery (e.g., from `@mui/material`
or your project's UI lib) and import useWindowVirtualizer from the
virtualization library you use (e.g., `@tanstack/react-virtual`), then ensure the
symbols used in CampaignsTable (useMediaQuery and useWindowVirtualizer) refer to
those imports.

---

Outside diff comments:
In `@backend/src/index.ts`:
- Around line 561-628: The error middleware is broken by duplicated/stray code
and an incorrectly closed handler; replace the two fragments with one proper
Express error-handling middleware using the four-argument signature (err, req,
res, next) registered via app.use, keep the CORS branch for err.message === 'Not
allowed by CORS' inside that function, then compute statusCode and code (using
AppError), build the ApiErrorResponse (using RequestWithId for requestId), call
logError with the same metadata, and finally send
res.status(statusCode).json(response); remove the duplicated blocks and the
stray closing tokens so the handler is a single coherent function using app.use,
AppError, ApiErrorResponse, RequestWithId, and logError.

In `@backend/src/services/campaignStore.ts`:
- Around line 370-395: The data query is not using the same WHERE applied to
baseQuery so countQuery is filtered but dataQuery isn’t; update dataQuery to
build from the same baseQuery (or append the same whereClauses.join(' AND '))
rather than interpolating the stale whereClause variable, and fix parameter
handling so the data query uses a params copy with limit/offset (e.g., create
dataParams = params.slice(); if (paginate) dataParams.push(limit, offset)) while
leaving the original params for countQuery; adjust usage of
db.prepare(...).all(...) to pass dataParams for the SELECT rows and params for
the COUNT.

In `@frontend/src/App.tsx`:
- Line 1: The file is missing imports for hooks used elsewhere—add useRef to the
React import (alongside useEffect, useMemo, useState) and import useNavigate and
useParams from react-router-dom so references to useRef, useNavigate, and
useParams compile; update the top-level import lines in App.tsx to include these
symbols.
- Around line 461-468: The handlers are currently calling
refreshCampaigns(campaign.id) which mistakenly passes the campaign id into the
searchQuery parameter; change calls to pass the id as the nextSelectedId
argument instead of searchQuery (i.e., call refreshCampaigns with the search
query left as its default/empty value and campaign.id as the nextSelectedId).
Update handleCreate and the pledge/claim/refund call sites (the places that call
refreshCampaigns after create/pledge/claim/refund) to use the campaign id as
nextSelectedId so the UI refreshes normally and keeps that campaign selected.

In `@frontend/src/components/CampaignsTable.tsx`:
- Around line 301-434: The mobile JSX block is broken by leftover table elements
and duplicated card markup after the virtualization rewrite; fix the mobile
branch by removing stray table fragments (</td>, </tr>, the tbody/table
wrappers) and deleting the duplicate non-virtualized "cards-only" mapping so
only the virtualized mapping using virtualizer.getVirtualItems(), article
elements (with ref={virtualizer.measureElement}), and the existing usage of
filteredCampaigns, selectedCampaignId, onSelect, AddressAvatar, getStatusLabel,
and formatTimestamp remain; ensure each article is properly closed and there are
no duplicated card lists.