SnapAPI session 65: PDF output feature + QA pass (490 tests)

projects/snapapi/memory/bugs.md

@@ -124,6 +124,24 @@
 - **Production:** Awaiting investor approval for v* tag
 
 ### BUG-011: No URL length limit (HIGH) — FIXED (staging)
+
+## Open
+
+### BUG-020: /status returns 200 instead of 301 redirect (LOW)
+- **Severity:** LOW
+- **Endpoint:** `GET /status`
+- **Expected:** 301 redirect to `/status.html` (consistent with /privacy, /terms, /impressum, /compare, /blog, /guides/quick-start which all 301)
+- **Actual:** Returns 200 serving the page directly
+- **Found:** Session 65b QA (2026-03-06)
+- **Impact:** Inconsistent clean URL behavior. All other clean URLs redirect to .html, /status does not. SEO implications (duplicate content at two URLs without redirect).
+
+### BUG-021: Long URL validation untestable via playground due to shared rate limit (LOW)
+- **Severity:** LOW (testing gap, not a code bug)
+- **Endpoint:** `POST /v1/playground`
+- **Expected:** URL >2048 chars returns 400
+- **Actual:** Cannot verify — SSRF protection tests consume the 5 req/hour playground rate limit, so subsequent long URL test gets 429 instead of 400
+- **Found:** Session 65b QA (2026-03-06)
+- **Impact:** URL length validation cannot be independently verified via playground when other playground tests run first. Consider: rate limit should not apply before URL validation, or URL validation tests need a separate endpoint.
 - **Found:** Session 17 QA
 - **Impact:** Extremely long URLs could waste server resources
 - **Fix:** Added 2048 character URL length limit in SSRF validation (returns 400)