On July 18, we completed a full security audit across every module in the Grams Left codebase. This was a comprehensive sweep designed to catch edge cases before they could affect real-world usage.
The Numbers
We ran 1,353 automated adversarial tests covering malformed inputs, injection attacks, boundary conditions, and runtime crash guards. 16 bugs were fixed — ranging from minor UI glitches to more serious stability improvements.
What We Found and Fixed
XSS Protection in Date Formatting
Date formatting utilities that render directly into the DOM needed explicit sanitisation. User-provided timestamps and locale strings are now properly escaped, removing a potential vector for cross-site scripting in edge-case date inputs.
Overflow Guards in THC Calculations
THC percentage and milligram calculations across multiple products could overflow under extreme values. We added explicit bounds checking so that no input — however large or small — can produce nonsense numbers or crash the tracker.
Crash Protection on Non-String Strain Input
Strain names from external sources (imports, API results) were not always guaranteed to be strings. A type-coercion edge case could cause the strain display component to crash. The component now gracefully handles any input type.
NaN-Safe Stats Computation
Burn rate and run-out date calculations are only as good as the data they receive. When a tracker had zero consumption days or all entries fell outside the analysis window, division-by-zero could produce NaN values. Stats now default to sensible fallbacks (such as "not enough data" rather than "NaN days remaining").
All Existing Tests Pass
Importantly, all existing tests continued to pass throughout the hardening process. The adversarial sweep was designed to catch unknown unknowns without breaking known-knowns — and it did exactly that.
Why This Matters for Patients
When you are tracking medical cannabis stock across multiple products, you need the app to work reliably. A crash or a garbled number at the wrong time is more than frustrating — it can be stressful. These fixes ensure the tracker stays stable, predictable, and trustworthy.
What Is Next
Security and stability hardening is not a one-off project. We have integrated the adversarial test suite into our CI pipeline, so every future change is run against the same battery of tests before it ships. That means new features and fixes are automatically checked for the same classes of issues that this audit uncovered.
If you have questions about the security of your data or want to know more about how we approach reliability, feel free to reach out at support@gramsleft.com.