Good First Issues

This is a list of JavaScript repositories with good first issues for newcomers to open source. Contributions are welcome!

This list gets updated every day at midnight.

KanishJebaMathewM/Truxify

• Feature: Redesign & Animate Truxify Onboarding Logo
• Missing const Keywords for Widget Constructors

JSONbored/metagraphed

• Add ?format=csv to GET /api/v1/candidates and /api/v1/subnets/{netuid}/candidates (candidate surfaces export)
• Enrich SN49 Nepher Robotics — add SSE stream
• Enrich SN33 ReadyAI — add public API endpoint + SSE stream
• Enrich SN74 Gittensor — add SSE stream
• Enrich SN56 Gradients — add SSE stream
• Enrich SN122 Bitrecs — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN92 Tensorclaw — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN57 Sparket — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN84 ansuz — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN12 Compute Horde — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN52 Dojo — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN29 Coldint — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN16 BitAds — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN10 Swap — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN102 ConnitoAI — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN61 RedTeam — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN8 Vanta — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN91 Bitstarter #1 — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN5 Hone — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN3 Templar — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN113 TensorUSD — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN100 Plaτform — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN88 Investing — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN2 DSperse — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN117 BrainPlay — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN1 Apex — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN98 ForeverMoney — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN121 sundae_bar — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN114 SOMA — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN103 Djinn — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN32 ItsAI — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN21 AdTAO — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN45 Talisman AI — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN25 Mainframe — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN9 iota — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN63 Enigma — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN48 Quantum Compute — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN82 Compelle — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN79 MVTRX — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN72 StreetVision by NATIX — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN110 Green Compute — add SSE stream
• Enrich SN120 Affine — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN83 CliqueAI — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN77 Liquidity — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN71 Leadpoet — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN128 ByteLeap — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN124 Swarm — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN105 Beam — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN50 Synth — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN41 Almanac — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN35 OxMarkets — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN127 Astrid — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN67 Harnyx — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN54 Yanez MIID — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN44 Score — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN60 Bitsec.ai — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN126 Poker44 — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN99 Leoma — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN55 NIOME — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN112 minotaur — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN36 Eirel — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN26 Perturb — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN108 TalkHead — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN70 NexisGen — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN68 NOVA — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN24 Quasar — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN65 TAO Private Network — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN17 404—GEN — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN93 Bitcast — add public API endpoint + OpenAPI/Swagger spec
• Enrich SN66 ninja — add OpenAPI/Swagger spec
• Enrich SN23 Trishool — add OpenAPI/Swagger spec
• Enrich SN107 Minos — add OpenAPI/Swagger spec
• Enrich SN51 lium.io — add OpenAPI/Swagger spec

SecureBananaLabs/bug-bounty

• Low Handing Fruit Automation
• Refresh token endpoint ignores the provided refresh token
• Registration token subject can drift from returned user id
• fix(auth): prevent admin role self-assignment during registration
• Bug: Proposal creation accepts records missing estimated duration
• Bug: Missing admin role authorization check on admin metrics endpoint
• Bug: Refresh endpoint mints tokens without validating a refresh token
• User creation endpoint has no input validation
• Payment endpoint lacks authentication — unauthenticated payment creation
• Upload endpoint lacks authentication — unauthenticated file uploads allowed
• Admin routes lack role-based access control — any authenticated user can access admin endpoints
• Pixel Art Creation with high Creative Thinking
• Search endpoint has no input validation or length limit on query
• Benchmark APIs with p50, p95, p99 latency, RPS, error rate and TTFB
• @freelanceflow/ui package entrypoint should be directly importable (reissue via #743)
• Notification creation should preserve server-owned id and read state
• Job validation should reject inverted budget ranges
• Payment API should require authentication
• registerUser access token can reference a different user id
• auth refresh endpoint issues tokens without verifying the requester
• upload endpoint accepts empty file submissions as successful uploads
• Technical Poem Generation and Content Creation
• fix: prevent admin role self-assignment during registration
• fix: enforce authentication on job creation endpoint
• fix: prevent admin role self-assignment
• fix: prevent admin role self-assignment during registration
• fix: prevent admin role self-assignment
• Bug: Multiple security vulnerabilities in API layer - registerUser() ID mismatch, missing auth, missing validation
• Implement Secure Payment Gateway and Payment Service
• Search endpoint has no input validation or length limit on query
• CORS configured with no origin restrictions — allows any domain
• Job creation endpoint lacks authentication — anyone can post jobs
• Patch PostCSS audit advisory from Next dependency lockfile
• fix: prevent DoS on search endpoint via query length limit and input validation
• Settings page should provide actionable account controls
• Settings page should provide actionable account controls
• Bug: Admin role self-assignment via registration endpoint
• Job detail page should render matching mock job and unknown fallback
• Job detail route should resolve mock jobs by id
• Freelancer profile should render matching mock profile and unknown fallback
• Registration token subject should match returned user id
• Registration should require fullName to match User model
• @freelanceflow/db package should expose an importable workspace entrypoint
• @freelanceflow/ui package entrypoint should be directly importable
• Job detail route should resolve mock jobs by id (reissue via #743)
• Settings page should provide actionable account controls
• Reject inverted job budget ranges in job validation
• Reject inverted job budget ranges in job validation
• Freelancer profile route should resolve mock profiles by username
• Calculate the exact value of PI #2872
• Calculate the exact value of PI
• Implement a fully functional Admin Panel
• Bug: registerUser signs token with a different generated user id
• Bug: user creation accepts empty payloads and client-controlled ids
• Bug: Rate limiter should count malformed JSON before body parsing

Aditya8369/Pollution-Control-Hub

• enhancement: Overhaul Dashboard UI/UX with improved typography, spacing, and micro-interactions
• {Enhancement} Redesign the "Health Advisory" section for better readability

layer5io/docs

• [Docs] Improve Related Docs Links in Pinning Models to Dock Page

SandeepVashishtha/Eventra

• fix(secureStorage): defer module-level crypto initialization to prevent SSR crash
• [codex] guard csv exports for SSR
• [codex] guard lenis utils for SSR
• fix(getCountdown): add NaN guard to prevent invalid countdown output
• [Enhancement] Add clear-all action for recent search history in Events dashboard
• fix(waitlistUtils): return fallback from catch block in syncWaitlistFromServer
• fix(lenisUtils): add SSR guards to prevent crash in server environments
• fix(exportCsv): add SSR guard to prevent crash in server environments

OWASP/threat-dragon

• Add version to Docs site
• Buildx provided with unexpected input
• Add version field and custom date in the model and the Report
• Automation: Trivy misreporting in housekeeping
• Configurable OAuth Frontend URL Override / NODE_ENV Documentation
• Feature: provide quick-start guide for new users

flatpak/flatpak-github-actions

• Investigate why $ in commands is probelmatic for json parser

TryGhost/Ghost

• {{contrast_text_color}} helper returns incorrect text color
• Storage adapters (and possibly other types) placed in the content folder are not detected.
• 🌐 i18n mega-issue
• Editor opening staff settings/profile triggers forbidden API calls and unrelated permission toast
• Incorrect links from Top sources in analytics
• The loader image in the dashboard is not transparent
• Dark mode / light mode transitions are incorrect for most analytics sections/buttons
• Bookmark for YouTube links not populated with video metadata
• a11y: kg-toggle-card not usable properly with a screenreader
• Share profile image generation is broken for some avatars and cover images

nodejs/node

• test_runner: do not read from process.argv and process.cwd() in run()
• test_runner: print failed coverage reports with dot runner
• fs: utf8 fast paths don't accept all valid utf8 values

simple-icons/simple-icons

• Request: Wiz
• Request: Nagios

meshery/meshery.io

• Website: Consolidate duplicative and unused CSS
• [DevOps] Populate Meshery Catalog with Sample Apps using meshery UI

vercel/next.js

• ISG with GIP in _app overrides cache-control of ISG page
• getInitialProps is not running when Router.replace's "href" and "as" contains hash and query params inside "href" change.

nextcloud/spreed

• Talk attachment failure for files from shared folders and local uploads since the last update (Web Version)
• Delete messages completely instead of showing "Message deleted by you" in "Note to self"
• Go back to autopilot mode if re-clicking selected participant
• Imprint and privacy links in public talk conversations
• Migrate addParticipantToRoom to InvitationList
• Migrate OCC to InvitationList
• talk couldn't work after install the “talk_matterbridge”
• Write tests for "Team resources" integration
• System message shows "guest added user" to a conversation when adding through circle/team
• Reactions notifications when fully subscribed in federated conversations
• Limit to groups in federated target server breaks federation
• Temporary message added before date separator
• Instant meeting outside of dashboard?
• Recording chunked upload would fail with token length > 13
• Compatibility with Cloudflare Calls (TURN & STUN servers)
• Change participants info button from hover tooltip to popover

louislam/uptime-kuma

• Pausing a group does not pause the individual monitors of that group
• On the maintenance creation form, link start and end times together

carvalho-jefferson/guicu

• Melhorar aparência da barra de rolagem
• Ajustar nome do arquivo exportado
• Permitir duplicar currículos na barra de ferramentas

saketnayak/trading-command-center

• feat: support Fidelity brokerage CSV format for portfolio import

Avenx-JS/avenx-js

• Update Documentation with Runtime Error Code AVX_R13 (DOM_PARSING_FAILED)
• Document SVG Namespace Handling and Rendering Support
• Update Documentation with Runtime Error Code AVX_R12 (LIFECYCLE_HOOK_ERROR)
• Missing Documentation: Client-side URL Query Parameter Parsing (state.query)
• Import and Package Name Inconsistencies (avenx-js vs. avenx-core)
• CLI Environment Variable Injection (.env Support)
• Add Watch Mode (--watch) in Custom Test Runner
• Component Custom Event Emission ($emit)
• Declarative State Persistence Utility (data-persist)
• Add Standalone "avenx watch" Command to CLI
• CLI "init" command does not generate a package.json, requiring manual npm init
• Unmounting components does not remove the instance reference from the DOM element
• registerBridge swallows constructor exceptions and falls back to using the function itself
• Unused HtmlDiff class in renderer is dead code
• CLI commands generate files in incorrect relative paths when run from subdirectories
• Handle EADDRINUSE errors in development server gracefully
• Colorful formatting for CLI help outputs
• CLI command to delete scaffolded components (avenx destroy <name>)
• Only log newly created directories in "avenx init"
• Expose active route parameters ($route) in all components
• Add version flag (-v / --version) to CLI
• Add "avenx clean" command to clear build output
• Write unit tests for escapeHtml.js security utility