findByVerificationCode in certificate-verification.service.ts:21-38 filters on status = 'active' but never checks expiresAt, even though the entity exposes an isExpired() getter (certificate.entity.ts:174-177). Any certificate whose expiresAt has passed but which has not yet been swept by the expiration job verifies as fully valid and even emits a CERTIFICATE_VERIFIED webhook. Fix: add AND (certificate.expiresAt IS NULL OR certificate.expiresAt > NOW()) to the query, or reject when isExpired().
findByVerificationCodeincertificate-verification.service.ts:21-38filters onstatus = 'active'but never checksexpiresAt, even though the entity exposes anisExpired()getter (certificate.entity.ts:174-177). Any certificate whoseexpiresAthas passed but which has not yet been swept by the expiration job verifies as fully valid and even emits aCERTIFICATE_VERIFIEDwebhook. Fix: addAND (certificate.expiresAt IS NULL OR certificate.expiresAt > NOW())to the query, or reject whenisExpired().