Issues

• A self-hoster's /docs Try-It-Out fires requests at registry.mpak.dev

  NimbleBrainInc/mpak#180 · Filter by author mgoldsborough opened on Jul 30, 2026

• Nothing fails if the analytics snippet stops being emitted

  NimbleBrainInc/mpak#178 · Filter by author mgoldsborough opened on Jul 30, 2026

• Decide the analytics consent posture for registry.mpak.dev

  NimbleBrainInc/mpak#177 · Filter by author mgoldsborough opened on Jul 30, 2026

• The Compose stack has no path router, so browser-side API calls 404

  NimbleBrainInc/mpak#176 · Filter by author mgoldsborough opened on Jul 29, 2026

• The bundled Helm chart's web pod has no way to address the registry

  NimbleBrainInc/mpak#175 · Filter by author mgoldsborough opened on Jul 29, 2026

• Security headers are dropped on error responses; set them in entry.server instead of per route

  bugpkg/websecurity
  NimbleBrainInc/mpak#168 · Filter by author mgoldsborough opened on Jul 29, 2026

• Size the web memory limit from a loaded measurement, not the idle figure

  bugpkg/web
  NimbleBrainInc/mpak#167 · Filter by author mgoldsborough opened on Jul 29, 2026

• Cutover needs a redirect path for /packages/* and /bundles off mpak.dev

  bugpkg/web
  NimbleBrainInc/mpak#166 · Filter by author mgoldsborough opened on Jul 29, 2026

• No repair lever for a README that failed to resolve on first ingest

  NimbleBrainInc/mpak#161 · Filter by author mgoldsborough opened on Jul 27, 2026

• inferPlatform conflates "no arch token" with "arch token we don't parse"

  NimbleBrainInc/mpak#160 · Filter by author mgoldsborough opened on Jul 27, 2026

• SDK cannot download on any platform outside the download query enums

  NimbleBrainInc/mpak#159 · Filter by author mgoldsborough opened on Jul 27, 2026

• ingest: a failed scan trigger leaves the version permanently unscanned

  NimbleBrainInc/mpak#157 · Filter by author mgoldsborough opened on Jul 27, 2026

• registry: ingest uploads to S3 before the ownership check, so a refused write leaves the object behind

  bugpkg/registry
  NimbleBrainInc/mpak#156 · Filter by author mgoldsborough opened on Jul 27, 2026

• ingest: S3 write happens before the ownership transaction

  NimbleBrainInc/mpak#155 · Filter by author mgoldsborough opened on Jul 27, 2026

• announce can overwrite a published artifact; the upload path refuses to

  bugpkg/registrysecurity
  NimbleBrainInc/mpak#153 · Filter by author mgoldsborough opened on Jul 25, 2026

• SDK getBundleDownload treats platform as optional, but the download endpoint requires os/arch

  buggood first issuepkg/sdk-typescript
  NimbleBrainInc/mpak#149 · Filter by author mgoldsborough opened on Jul 25, 2026
  1

• CQ-05 / CD-02 exclude files by DEP_DIRS substring — over-matches (e.g. depsolver.js) and is author-evadable

  NimbleBrainInc/mpak#145 · Filter by author mgoldsborough opened on Jul 22, 2026

• CQ-01 flags URL-construction code, doc examples, and dependency files as embedded secrets

  bugfalse-positivepkg/scanner
  NimbleBrainInc/mpak#143 · Filter by author mgoldsborough opened on Jul 22, 2026

• Add owner/admin deprecate + delist for registry packages

  enhancementpkg/registrypkg/web
  NimbleBrainInc/mpak#142 · Filter by author mgoldsborough opened on Jul 22, 2026

• CQ-02 false-positives on bundled JavaScript, where dependencies are inlined rather than vendored

  bugfalse-positivepkg/scanner
  NimbleBrainInc/mpak#139 · Filter by author mgoldsborough opened on Jul 21, 2026

• e2e suite cannot run in CI: no external toolchain, and a missing corpus skips silently

  pkg/scannertesting
  NimbleBrainInc/mpak#137 · Filter by author mgoldsborough opened on Jul 21, 2026
  1

• CQ-02 exempts dependency findings by path, which the bundle author controls

  bugfalse-positivepkg/scanner
  NimbleBrainInc/mpak#136 · Filter by author mgoldsborough opened on Jul 21, 2026

• Scanner executed binaries supplied by the bundle it was scanning

  bugpkg/scannersecurity
  NimbleBrainInc/mpak#131 · Filter by author mgoldsborough opened on Jul 20, 2026

• Rate limiter returns HTTP 500 instead of 429 when limit exceeded

  NimbleBrainInc/mpak#120 · Filter by author mgoldsborough opened on May 27, 2026

• sdk(ts,python): non-404 HTTP errors lose status + envelope detail

  NimbleBrainInc/mpak#116 · Filter by author Ovaculos opened on May 14, 2026