-
Notifications
You must be signed in to change notification settings - Fork 3
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
- Status: Open.#487 In intentdriven/abcd;
- Status: Open.#488 In intentdriven/abcd;
- Status: Open.#486 In intentdriven/abcd;
abcd capture kebab-cases the home path before redaction, so the username still lands in the filename
Status: Open.#485 In intentdriven/abcd;Percent-encoded delimiters defeat the leading
\bon every secret token pattern, so a live PAT/JWT/AWS-key embedded in a URL-encoded URL (%3Dghp_…) surviveshistory.Captureredaction and is written raw into the committed transcriptbugSomething isn't workingSomething isn't workingneeds-fixvalidated bug awaiting a fixvalidated bug awaiting a fixseverity:criticalsilent security/data-loss at a trust boundarysilent security/data-loss at a trust boundaryStatus: Open.#370 In intentdriven/abcd;- Status: Open.#368 In intentdriven/abcd;
A
rootsentry pointing at a directory that does not exist makesabcd docs lint/ record-lint pass with zero findings — every per-file blocker rule for that tree is silently disarmed, and the shipped scaffold'sroots: ["docs", …]default triggers it in any adopter repo whose docs live elsewherebugSomething isn't workingSomething isn't workingneeds-fixvalidated bug awaiting a fixvalidated bug awaiting a fixseverity:majorwrong result on reachable inputwrong result on reachable inputStatus: Open.#360 In intentdriven/abcd;aws_access_keysecret pattern matches onlyAKIA, so anASIA-prefixed temporary STS access key ID ships/writes to history un-redacted while its shape-identicalAKIAsibling is a hard_fail blockbugSomething isn't workingSomething isn't workingneeds-fixvalidated bug awaiting a fixvalidated bug awaiting a fixseverity:majorwrong result on reachable inputwrong result on reachable inputStatus: Open.#358 In intentdriven/abcd;record-lint reads record frontmatter with the lenient canonical scanner while capture's strict parser refuses the same bytes — a duplicated key or block-sequence field ships lint-green but is skipped by every capture verb, a duplicate
impact:key silences the armedissue_impact_validblocker, andid :(one space before the colon) bypassesrecord_schema's filename↔id blocker on every record storebugSomething isn't workingSomething isn't workingneeds-fixvalidated bug awaiting a fixvalidated bug awaiting a fixseverity:majorwrong result on reachable inputwrong result on reachable inputStatus: Open.#357 In intentdriven/abcd;abcd guardsilently allows every blocker run throughwatch '<cmd>'/ GNUparallel— these single-string launchers pass their command tosh -cbut are in no launcher table, so the quoted payload stays one opaque token that defeats even the Tier-2 fail-safebugSomething isn't workingSomething isn't workingneeds-fixvalidated bug awaiting a fixvalidated bug awaiting a fixseverity:majorwrong result on reachable inputwrong result on reachable inputStatus: Open.#354 In intentdriven/abcd;abcd guardsilently allows every blocker run throughrbash -c/yash -c—isShellFamilyomits these two real shells, so the-cpayload is never descended into (the unswept sibling of the closed zsh/ksh interpreter fix)bugSomething isn't workingSomething isn't workingneeds-fixvalidated bug awaiting a fixvalidated bug awaiting a fixseverity:majorwrong result on reachable inputwrong result on reachable inputStatus: Open.#353 In intentdriven/abcd;walkLifeboatFileswalks an untrusted lifeboat withfs.WalkDir(unboundedReadDir(-1)per directory), so one wide directory materialises + sorts its entire entry list before themaxEmbarkFilescap can fire — the embark sibling of the probe.go walk that iss-112 already boundedbugSomething isn't workingSomething isn't workingneeds-fixvalidated bug awaiting a fixvalidated bug awaiting a fixseverity:majorwrong result on reachable inputwrong result on reachable inputStatus: Open.#343 In intentdriven/abcd;