Docs

treesandrain

Should be self explanatory from video

[Screen_Recording_20251224_074650_Toolix.mp4](https://uploads.linear.app/8eae091a-5216-4521-9e9c-f7883369fdb3/7bfcb348-7e47-4be0-ad38-145dda07fa64/58771ceb-c471-4aab-83ed-9d07fcab3984)

Cannot Close Date Picker / Select Return by Date

Facebook auth

people should not be able to remove friends until all tools are returned on both sides and warning should occur when this happens so they know why 

Removing friends

Implement IAP for support

Implement Pro Subscription and associated pages

create notifications system for request etc

Notifications

# Case Inconsistency

When selecting a *Condition* from *Add New Tool*, the Condition shown in the drop-down is lowercase while the conditions in the drop-downs list are uppercase. *Condition* is the only menu where this occurs.

![Screenshot_20251221_185859_Toolix.jpg](https://uploads.linear.app/8eae091a-5216-4521-9e9c-f7883369fdb3/9a5c1478-e35c-454c-97ca-96c2efd1f51a/416d62f9-43b2-429f-b6f6-4f3264c3c617)

# Add Tool Button Hidden

The *Add Tool* button appears below the home menu on Android

![image.png](https://uploads.linear.app/8eae091a-5216-4521-9e9c-f7883369fdb3/af2f57a0-94d3-462e-86bb-6bc769e76507/03c838e1-86d5-4849-8768-f0ec9fa69466)

# Input Sanitization

I spent \~10 years red-teaming, but never touched mobile. I'm not sure if any of this could be exploitable and I didn't really try (beyond testing the limits of what I could enter). Not sure if XSS or other script injection is possible, but it's probably worth sanitizing input to be certain.

![image.png](https://uploads.linear.app/8eae091a-5216-4521-9e9c-f7883369fdb3/1e8ed2ae-0682-44f7-a50e-08f91a2b3755/dd62bc40-aa29-46c8-bcfc-efddb28f4cc0)

Allowing invalid dates (like a date in the future) likely doesn't lead to any exploit, but it could lead to logic bugs later down the road. At a minimum, I'd set a lower bound and not allow dates in the future.

![image.png](https://uploads.linear.app/8eae091a-5216-4521-9e9c-f7883369fdb3/b3be07c0-157a-4852-af01-eca6e940610f/c68af8c5-63bd-414f-828b-84fe4722e4e3)

Requests

Toolix