-
Notifications
You must be signed in to change notification settings - Fork 1
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
Password-login throttle: LoginThrottle.sweep() is never scheduled (unbounded bucket growth) + check-then-increment race
bugSomething isn't workingSomething isn't workingsecuritySecurity-relevant issueSecurity-relevant issueStatus: Open.#20 In AZX-PBC-OSS/helix;- Status: Open.#19 In AZX-PBC-OSS/helix;
Audit ledger is append-only by grant, not tamper-evident (P0 user story unmet); portal role can rewrite history
importantShould be fixed before releaseShould be fixed before releasesecuritySecurity-relevant issueSecurity-relevant issueStatus: Open.#17 In AZX-PBC-OSS/helix;Untrusted apps share the registrable domain (azx-labs.com) with portal/auth — use a separate eTLD+1
importantShould be fixed before releaseShould be fixed before releasesecuritySecurity-relevant issueSecurity-relevant issueStatus: Open.#16 In AZX-PBC-OSS/helix;Attested instruction binds only the origin (method/path/query/body unsigned); no aud or key rotation
importantShould be fixed before releaseShould be fixed before releasesecuritySecurity-relevant issueSecurity-relevant issueStatus: Open.#6 In AZX-PBC-OSS/helix;Edge↔egress hop is plain HTTP (no TLS in the seam)
importantShould be fixed before releaseShould be fixed before releasesecuritySecurity-relevant issueSecurity-relevant issueStatus: Open.#5 In AZX-PBC-OSS/helix;