Search results

CREATE INDEX on TYPE DOCUMENT STRICT collections silently no-ops — index_paths not registered

Status: Open.

#63 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] HIGH: API-key rotation leaves old key valid forever; WASM upload endpoint hardcodes tenant 0 with no auth (2 sub-items)

Status: Open.

#62 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] CRITICAL+HIGH: JWKS single-provider fallback bypasses issuer validation; JWKS URL fetch is unrestricted (SSRF to cloud metadata) (2 sub-items)

Status: Open.

#61 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] CRITICAL+HIGH: BACKUP TENANT allows arbitrary filesystem write; RESTORE version mismatch bricks recovery + reads attacker-controlled path before validation (2 sub-items)

Status: Open.

#60 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

CRITICAL: Session handles generated from timestamp + monotonic counter (not CSPRNG) — guessable, gives full AuthContext to any observer

Status: Open.

#59 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] CRITICAL: Cluster QUIC transport skips certificate verification and client auth by default; frames lack MAC (2 sub-items)

Status: Open.

#58 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] HIGH: FTS BM25 stats drift; fuzzy byte-wise Levenshtein + full-dict scan; UPSERT unescaped column identifiers; cron scheduler misses minutes on jitter (4 sub-items)

Status: Open.

#57 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] CRITICAL+HIGH: Materialized view refresh ignores SELECT; RLS fails open on deser error; COMMIT OFFSET regression accepted (3 sub-items)

Status: Open.

#56 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] CRITICAL: HTTP and WebSocket endpoints accept unauthenticated requests (WS RPC / stream poll / stream SSE) (3 sub-items)

Status: Open.

#55 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] HIGH: Graph engine internals — variable-length expansion, label u16 wrap, BFS RPC amplification, non-atomic graph index build (4 sub-items)

Status: Open.

#53 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] HIGH: Graph DSL handlers — parser correctness, result correctness, tenant-scope leak (4 sub-items)

Status: Open.

#52 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026

[Epic] CRITICAL+HIGH: Async runtime CPU/RAM hotspots — CDC fan-out clones, detached task leaks, unbounded queues (7 sub-items)

Status: Open.

#51 In NodeDB-Lab/nodedb;

· hollanf opened on Apr 16, 2026