Search results

Pin full-scan fallback can replicate an unreachable private blob in cleartext

Status: Open.

#99 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

fork_repo clones a full mirror after only a root (/) visibility check, bypassing path-scoped withholding

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

subsystem:visibilityPath-scoped visibility and content withholdingPath-scoped visibility and content withholding

Status: Open.

#98 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

Private repos (is_public=false) are enumerable via unauthenticated list/stats/GraphQL surfaces

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

subsystem:visibilityPath-scoped visibility and content withholdingPath-scoped visibility and content withholding

Status: Open.

#97 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

sync_queue: enqueue_sync ON CONFLICT DO NOTHING never dedupes; per-ref notify enqueues N redundant full fetches

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behavior

sev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-have

subsystem:replicationMirror, replica, and cross-node syncMirror, replica, and cross-node sync

Status: Open.

#96 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

Document a minimum supported Git version (blob:limit filter is version-sensitive)

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:docsDocs and comments onlyDocs and comments only

sev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-have

subsystem:replicationMirror, replica, and cross-node syncMirror, replica, and cross-node sync

Status: Open.

#95 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

Unauthenticated GET /repos/:owner/:repo/hooks leaks webhook target URLs for any repo

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

Status: Open.

#94 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

gossip_task uses a redirect-following client, enabling SSRF on the peer-ping path

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registry

Status: Open.

#93 In Gitlawb/node;

· beardthelion opened on Jun 24, 2026

feat(storage): backend-agnostic BlobStore layer (S3 / filesystem / IPFS)

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:featureNew capability or surfaceNew capability or surface

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:storageBlob/object store, Arweave, IPFS, archivesBlob/object store, Arweave, IPFS, archives

Status: Open.

#89 In Gitlawb/node;

· kevincodex1 opened on Jun 23, 2026

Need to address bots polluting our platform. We need to put in place a stronger reputation before craeting more repos

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:featureNew capability or surfaceNew capability or surface

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registry

Status: Open.

#86 In Gitlawb/node;

· kevincodex1 opened on Jun 23, 2026

Unauthenticated POST /api/v1/sync/trigger drives outbound fan-out and queue flooding

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:mediumDegraded but workaround existsDegraded but workaround exists

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

subsystem:peersPeer announce, discovery, and registryPeer announce, discovery, and registry

Status: Open.

#82 In Gitlawb/node;

· beardthelion opened on Jun 22, 2026

Webhook delivery is an unvalidated SSRF sink with no repo-ownership check

crate:nodegitlawb-node — the serving node and REST APIgitlawb-node — the serving node and REST API

kind:securityVulnerability fix or hardeningVulnerability fix or hardening

sev:highMajor break or real security/trust risk, no easy workaroundMajor break or real security/trust risk, no easy workaround

subsystem:apiNode REST API request/response surfaceNode REST API request/response surface

Status: Open.

#81 In Gitlawb/node;

· beardthelion opened on Jun 22, 2026

git remote helper drops the HTTP error body on failed push/fetch, hiding the server's rejection reason

bugSomething isn't workingSomething isn't working

crate:git-remotegit-remote-gitlawb — the git remote helpergit-remote-gitlawb — the git remote helper

good first issueGood for newcomersGood for newcomers

kind:bugDefect fix — wrong or unsafe behaviorDefect fix — wrong or unsafe behavior

sev:lowCosmetic, cleanup, or nice-to-haveCosmetic, cleanup, or nice-to-have

Status: Open.

#77 In Gitlawb/node;

· beardthelion opened on Jun 22, 2026