Issues

• core: RefUpdateCert threshold 0 always passes, no replay enforcement, and DID multibase prefixes are not canonical

  crate:corekind:securitysev:highsubsystem:attestationsubsystem:identity
  Twigpine/node#509 · Filter by author PierrunoYT opened on Oct 2, 2026

• attest: verifier reports fully_verified for any self-signed attestation

  crate:attestkind:securitysev:mediumsubsystem:attestationsubsystem:identity
  Twigpine/node#508 · Filter by author PierrunoYT opened on Oct 2, 2026

• icaptcha: public-key fetch follows redirects, unlike every other outbound client

  crate:nodekind:securitysev:mediumsubsystem:identity
  Twigpine/node#507 · Filter by author PierrunoYT opened on Oct 2, 2026

• webhooks: HMAC secrets stored in cleartext and exposed by derived Debug

  crate:nodekind:securitysev:highsubsystem:storage
  Twigpine/node#506 · Filter by author PierrunoYT opened on Oct 2, 2026

• ipfs_pin::cat and gl mcp read bodies without a real bound

  crate:glcrate:nodekind:securitysev:mediumsubsystem:storage
  Twigpine/node#504 · Filter by author PierrunoYT opened on Oct 2, 2026

• api: mutation handlers succeed on quarantined repos while push 404s

  crate:nodekind:securitysev:mediumsubsystem:api
  Twigpine/node#503 · Filter by author PierrunoYT opened on Oct 2, 2026

• git-remote-gitlawb: uncapped success-body reads, and key path falls back to ./.gitlawb when HOME is unset

  crate:git-remotekind:securitysev:mediumsubsystem:identitysubsystem:replication
  Twigpine/node#502 · Filter by author PierrunoYT opened on Oct 2, 2026

• ucan: verify_chain never anchors the chain root to the resource owner

  crate:corecrate:nodekind:securitysev:mediumsubsystem:identity
  Twigpine/node#501 · Filter by author PierrunoYT opened on Oct 2, 2026
  1

• api(encrypted): encrypted-blob and withheld-paths routes skip the quarantine gate

  crate:nodekind:securitysev:highsubsystem:apisubsystem:encryptionsubsystem:visibility
  Twigpine/node#499 · Filter by author PierrunoYT opened on Oct 2, 2026
  1

• create_task binds caller-supplied repo_id/assignee_did verbatim, allowing task injection under foreign repo ids

  kind:securitysev:highsubsystem:identity
  Twigpine/node#496 · Filter by author cairn-intern opened on Sep 28, 2026

• gl(mcp): ucan_delegate panics on overflow expiry and ucan_verify ignores nbf

  crate:glkind:securitysev:mediumsubsystem:identity
  Twigpine/node#494 · Filter by author euxaristia opened on Sep 26, 2026

• gl: unencoded path and query segments flow into signed requests

  crate:glkind:securitysev:mediumsubsystem:api
  Twigpine/node#493 · Filter by author euxaristia opened on Sep 26, 2026

• gl(name): on-chain name and DID registries accept registrations without proving control of the DID

  crate:glkind:securitysev:highsubsystem:identity
  Twigpine/node#492 · Filter by author euxaristia opened on Sep 26, 2026

• gl: quickstart and init silently regenerate an unreadable identity, orphaning the agent DID

  crate:glkind:securitysev:highsubsystem:identity
  Twigpine/node#491 · Filter by author euxaristia opened on Sep 26, 2026
  1

• api(arweave): negative limit reaches SQL LIMIT and surfaces as 503 db_unavailable

  crate:nodekind:bugsev:lowsubsystem:api
  Twigpine/node#490 · Filter by author euxaristia opened on Sep 26, 2026

• graphql(ws): Lagged errors are swallowed, so slow subscribers silently miss events

  crate:nodekind:bugsev:mediumsubsystem:api
  Twigpine/node#489 · Filter by author euxaristia opened on Sep 26, 2026

• operator: heartbeat loop has no timeout, so a hung chain RPC silently stops all heartbeats

  crate:nodekind:bugsev:mediumsubsystem:attestation
  Twigpine/node#488 · Filter by author euxaristia opened on Sep 26, 2026

• storage(tigris): cold acquire buffers the whole archive in RAM with no in-flight dedup

  crate:nodekind:securitysev:highsubsystem:apisubsystem:storage
  Twigpine/node#487 · Filter by author euxaristia opened on Sep 26, 2026

• storage: encrypt_and_pin re-seals withheld blobs through unbounded sync reads with no permit or budget

  crate:nodekind:bugsev:mediumsubsystem:encryptionsubsystem:storage
  Twigpine/node#486 · Filter by author euxaristia opened on Sep 26, 2026

• api(stats): every anonymous stats request loads the full repo inventory and all visibility rules

  crate:nodekind:securitysev:highsubsystem:api
  Twigpine/node#485 · Filter by author euxaristia opened on Sep 26, 2026

• api(pulls): PR diff route materializes unbounded diffs anonymously with no cap or admission

  crate:nodekind:securitysev:highsubsystem:api
  Twigpine/node#484 · Filter by author euxaristia opened on Sep 26, 2026

• gl: ucan show cannot decode the wrapper file that register writes

  crate:glkind:bugsev:mediumsubsystem:identity
  Twigpine/node#482 · Filter by author euxaristia opened on Sep 26, 2026
  1

• gl: min()-guarded slices still panic on UTF-8 char boundaries

  crate:glkind:bugsev:low
  Twigpine/node#481 · Filter by author euxaristia opened on Sep 26, 2026

• gl: ETH private key and UCAN token accepted as command-line arguments

  crate:glkind:securitysev:mediumsubsystem:identity
  Twigpine/node#480 · Filter by author euxaristia opened on Sep 26, 2026
  1

• metrics: repo counter labels grow unbounded from owner/name path params

  crate:nodekind:bugsev:lowsubsystem:api
  Twigpine/node#478 · Filter by author euxaristia opened on Sep 26, 2026