Search results

Unauthenticated GET /repos/:owner/:repo/hooks leaks webhook target URLs for any repo

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

Status: Open.

#94 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

gossip_task uses a redirect-following client, enabling SSRF on the peer-ping path

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registry

Status: Open.

#93 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

feat(storage): backend-agnostic BlobStore layer (S3 / filesystem / IPFS)

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:featureNew capability or surfaceNew capability or surface

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:storageBlob/object store, Arweave, IPFS, archivesBlob/object store, Arweave, IPFS, archives

Status: Open.

#89 In Gitlawb/node;

· kevincodex1 opened on Jun 23, 2026

Need to address bots polluting our platform. We need to put in place a stronger reputation before craeting more repos

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:featureNew capability or surfaceNew capability or surface

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registry

Status: Open.

#86 In Gitlawb/node;

· kevincodex1 opened on Jun 23, 2026

Unauthenticated POST /api/v1/sync/trigger drives outbound fan-out and queue flooding

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

subsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registry

Status: Open.

#82 In Gitlawb/node;

· beardthelion opened on Jun 22, 2026

Webhook delivery is an unvalidated SSRF sink with no repo-ownership check

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

Status: Open.

#81 In Gitlawb/node;

· beardthelion opened on Jun 22, 2026

git remote helper drops the HTTP error body on failed push/fetch, hiding the server's rejection reason

bugSomething isn't workingSomething isn't working

crate:git-remotegit-remote-gitlawb — the git remote helpergit-remote-gitlawb — the git remote helper

good first issueGood for newcomersGood for newcomers

kind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behavior

sev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-have

Status: Open.

#77 In Gitlawb/node;

· beardthelion opened on Jun 22, 2026

Drop hickory advisory ignores once libp2p-dns ships hickory 0.26

kind:ciCI, release, or packaging pipelineCI, release, or packaging pipeline

sev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-have

Status: Open.

#76 In Gitlawb/node;

· beardthelion opened on Jun 22, 2026

validate_path_glob accepts malformed globs with non-trailing wildcards

bugSomething isn't workingSomething isn't working

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behavior

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:visibilityPath-scoped visibility and content withholdingPath-scoped visibility and content withholding

Status: Open.

#74 In Gitlawb/node;

· beardthelion opened on Jun 21, 2026

refactor(gl): extract Arweave discovery loop from clone.rs to cut file size and enable unit tests

crate:glgl — the contributor CLIgl — the contributor CLI

kind:refactorRestructure, behavior preservedRestructure, behavior preserved

sev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-have

subsystem:storageBlob/object store, Arweave, IPFS, archivesBlob/object store, Arweave, IPFS, archives

Status: Open.

#71 In Gitlawb/node;

· beardthelion opened on Jun 20, 2026

Harden x25519_secret_from_seed: zeroize the derived X25519 secret (follow-up to #41)

bugSomething isn't workingSomething isn't working

crate:coregitlawb-core — identity, certs, encrypt, DID/UCANgitlawb-core — identity, certs, encrypt, DID/UCAN

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:encryptionEncrypted subtrees, recipient blinding, key zeroizationEncrypted subtrees, recipient blinding, key zeroization

Status: Open.

#65 In Gitlawb/node;

· beardthelion opened on Jun 20, 2026

Harden served-git process handling: timeout, cross-env pid cap, wiring test (follow-up to #61)

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:mediumDegraded but workaround existsDegraded but workaround exists

Status: Open.

#62 In Gitlawb/node;

· beardthelion opened on Jun 19, 2026