-
-
Notifications
You must be signed in to change notification settings - Fork 1
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
[Bug]: SQL engine flags all '--' line comments as injection — false positives erode boundary trust
bugSomething isn't workingSomething isn't workingStatus: Open.#31 In QWED-AI/qwed-mcp;[Bug]: Provenance digest is format-checked but never content-verified — false integrity assurance
bugSomething isn't workingSomething isn't workingStatus: Open.#30 In QWED-AI/qwed-mcp;[Bug]: track_verification is dead code — Sentry security-event layer never fires for blocked decisions
bugSomething isn't workingSomething isn't workingStatus: Open.#29 In QWED-AI/qwed-mcp;[Bug]: Unbounded background job queue — pending_verifications has no depth cap (memory DoS)
bugSomething isn't workingSomething isn't workingStatus: Open.#28 In QWED-AI/qwed-mcp;[Bug]: SQL allowed_tables bypass — quoted/schema-qualified identifiers extract nothing, compliance check fails open
bugSomething isn't workingSomething isn't workingStatus: Open.#27 In QWED-AI/qwed-mcp;[Bug]: Logic engine 'is'/'is not' patterns silently drop RHS operand — returns verified=True for rewritten premises
bugSomething isn't workingSomething isn't workingStatus: Open.#26 In QWED-AI/qwed-mcp;[Bug]: Resource exhaustion through approved parser boundary — eager Pow/factorial evaluation (CWE-400 family of GHSA-mw6r-2hvm-4rp2)
bugSomething isn't workingSomething isn't workingStatus: Open.#25 In QWED-AI/qwed-mcp;[Bug]: Code engine bypassable via getattr/vars/__dict__/globals indirection + no network boundary — verified exfil chain
bugSomething isn't workingSomething isn't workingStatus: Open.#24 In QWED-AI/qwed-mcp;Fix Docker SBOM release asset upload permissions
bugSomething isn't workingSomething isn't workingStatus: Open.#23 In QWED-AI/qwed-mcp;[Bug]: Registry blocklist uses substring matching — same fail-open pattern as StatuteGuard #14
bugSomething isn't workingSomething isn't workingStatus: Open.#18 In QWED-AI/qwed-mcp;[Bug]: No MCP session binding — any client can access any job's verification results
bugSomething isn't workingSomething isn't workingStatus: Open.#17 In QWED-AI/qwed-mcp;[Bug]: Logic engine conflates parse errors with logical refutations — cannot distinguish DISPROVEN from UNVERIFIABLE
bugSomething isn't workingSomething isn't workingStatus: Open.#16 In QWED-AI/qwed-mcp;