Issues

• create_task binds caller-supplied repo_id/assignee_did verbatim, allowing task injection under foreign repo ids

  kind:securitysev:highsubsystem:identity
  Twigpine/node#496 · Filter by author cairn-intern opened on Sep 28, 2026

• gl(mcp): ucan_delegate panics on overflow expiry and ucan_verify ignores nbf

  crate:glkind:securitysev:mediumsubsystem:identity
  Twigpine/node#494 · Filter by author euxaristia opened on Sep 26, 2026

• gl: unencoded path and query segments flow into signed requests

  crate:glkind:securitysev:mediumsubsystem:api
  Twigpine/node#493 · Filter by author euxaristia opened on Sep 26, 2026

• gl(name): on-chain name and DID registries accept registrations without proving control of the DID

  crate:glkind:securitysev:highsubsystem:identity
  Twigpine/node#492 · Filter by author euxaristia opened on Sep 26, 2026

• gl: quickstart and init silently regenerate an unreadable identity, orphaning the agent DID

  crate:glkind:securitysev:highsubsystem:identity
  Twigpine/node#491 · Filter by author euxaristia opened on Sep 26, 2026
  1

• api(arweave): negative limit reaches SQL LIMIT and surfaces as 503 db_unavailable

  crate:nodekind:bugsev:lowsubsystem:api
  Twigpine/node#490 · Filter by author euxaristia opened on Sep 26, 2026

• graphql(ws): Lagged errors are swallowed, so slow subscribers silently miss events

  crate:nodekind:bugsev:mediumsubsystem:api
  Twigpine/node#489 · Filter by author euxaristia opened on Sep 26, 2026

• operator: heartbeat loop has no timeout, so a hung chain RPC silently stops all heartbeats

  crate:nodekind:bugsev:mediumsubsystem:attestation
  Twigpine/node#488 · Filter by author euxaristia opened on Sep 26, 2026

• storage(tigris): cold acquire buffers the whole archive in RAM with no in-flight dedup

  crate:nodekind:securitysev:highsubsystem:apisubsystem:storage
  Twigpine/node#487 · Filter by author euxaristia opened on Sep 26, 2026

• storage: encrypt_and_pin re-seals withheld blobs through unbounded sync reads with no permit or budget

  crate:nodekind:bugsev:mediumsubsystem:encryptionsubsystem:storage
  Twigpine/node#486 · Filter by author euxaristia opened on Sep 26, 2026

• api(stats): every anonymous stats request loads the full repo inventory and all visibility rules

  crate:nodekind:securitysev:highsubsystem:api
  Twigpine/node#485 · Filter by author euxaristia opened on Sep 26, 2026

• api(pulls): PR diff route materializes unbounded diffs anonymously with no cap or admission

  crate:nodekind:securitysev:highsubsystem:api
  Twigpine/node#484 · Filter by author euxaristia opened on Sep 26, 2026

• gl: ucan show cannot decode the wrapper file that register writes

  crate:glkind:bugsev:mediumsubsystem:identity
  Twigpine/node#482 · Filter by author euxaristia opened on Sep 26, 2026
  1

• gl: min()-guarded slices still panic on UTF-8 char boundaries

  crate:glkind:bugsev:low
  Twigpine/node#481 · Filter by author euxaristia opened on Sep 26, 2026

• gl: ETH private key and UCAN token accepted as command-line arguments

  crate:glkind:securitysev:mediumsubsystem:identity
  Twigpine/node#480 · Filter by author euxaristia opened on Sep 26, 2026
  1

• metrics: repo counter labels grow unbounded from owner/name path params

  crate:nodekind:bugsev:lowsubsystem:api
  Twigpine/node#478 · Filter by author euxaristia opened on Sep 26, 2026

• api(bounties): aggregates ignore repo visibility, exposing private-repo activity

  crate:nodekind:securitysev:mediumsubsystem:apisubsystem:visibility
  Twigpine/node#477 · Filter by author euxaristia opened on Sep 26, 2026
  2

• api(profiles): profile fields unbounded and PUT pins to Pinata unthrottled

  crate:nodekind:securitysev:mediumsubsystem:api
  Twigpine/node#476 · Filter by author euxaristia opened on Sep 26, 2026
  1

• api(replicas): validate_replica_url accepts loopback and private hosts

  crate:nodekind:securitysev:lowsubsystem:replication
  Twigpine/node#475 · Filter by author euxaristia opened on Sep 26, 2026
  1

• api(agents): DID prefix fallback can resolve a different agent than requested

  crate:nodekind:bugsev:mediumsubsystem:peers
  Twigpine/node#474 · Filter by author euxaristia opened on Sep 26, 2026
  1

• gl: uncapped success-body reads let a malicious node exhaust client memory

  crate:git-remotecrate:glkind:securitysev:medium
  Twigpine/node#473 · Filter by author euxaristia opened on Sep 26, 2026
  1

• sync: replicate path passes peer-supplied CIDs to Kubo unvalidated

  crate:nodekind:securitysev:mediumsubsystem:replication
  Twigpine/node#472 · Filter by author euxaristia opened on Sep 26, 2026
  1

• api(encrypted): encrypted-blob serving buffers whole envelopes with no cap or brake

  crate:nodekind:securitysev:highsubsystem:apisubsystem:storage
  Twigpine/node#471 · Filter by author euxaristia opened on Sep 26, 2026

• sync: ref-update notify fields stored unbounded, amplifying anonymous feed reads

  crate:nodekind:securitysev:highsubsystem:apisubsystem:peers
  Twigpine/node#470 · Filter by author euxaristia opened on Sep 26, 2026

• p2p(resolve): anonymous DID resolution spawns uncapped Kademlia queries that outlive their callers

  crate:nodekind:securitysev:highsubsystem:apisubsystem:peers
  Twigpine/node#469 · Filter by author euxaristia opened on Sep 26, 2026