REST API: `report_date` field returns empty object {} for all findings

[brunofuentes]

The REST API endpoint POST /api/v1/solodit/findings always returns report_date: {} (empty object) regardless of filters applied. This appears to be a serialization bug — the field is a JavaScript Date object on the server, and JSON.stringify() serializes Date instances as {} instead of an ISO string.

Steps to Reproduce:

curl -X POST https://solodit.cyfrin.io/api/v1/solodit/findings \
  -H "Content-Type: application/json" \
  -H "X-Cyfrin-API-Key: <YOUR_API_KEY>" \
  -d '{
    "page": 1,
    "pageSize": 2,
    "filters": { "languages": [{ "value": "Solidity" }] },
    "sortField": "Recency",
    "sortDirection": "Desc"
  }'

Expected:

{
  "report_date": "2026-03-25T00:00:00.000Z"
}

Actual:

{
  "report_date": {}
}

After investigating I found out that the internal tRPC endpoint (/api/trpc/findings.get) returns the date correctly via SuperJSON:
report_date: new Date(1774396800000). This confirms the data exists in the database. The issue might be related to the REST API's JSON serialization layer (?!).

I would really appreciate if you could look into this. Thanks!

[brunofuentes]

Two additional findings while investigating the API response:

1. protocols_protocol.protocols_protocolcategoryscore always returns []

protocols_protocolcategoryscore is always an empty array for all findings, even for protocols that are clearly categorized on the website (visible in the filter sidebar).

Example — finding ID 65085 (protocol: Abster Freefall):

"protocols_protocol": {
  "name": "Abster Freefall",
  "protocols_protocolcategoryscore": []
}

The website lists this protocol under DEX / AMM. Cross-referencing 100 findings from the API against the website showed 0 with a populated protocols_protocolcategoryscore, across all protocols.

2. Tag field name mismatch

The actual field name in the API response is issues_issuetagscore, but it is referred to as issues_issuetags in some documentation. The correct key per the official spec is issues_issuetagscore — just flagging in case the docs need updating.