-
-
Notifications
You must be signed in to change notification settings - Fork 12
All issues
Issue creation is restricted in this repository
- #216 · rahuldass19 opened
on Jul 23, 2026 6
Issues
is:issue state:open
is:issue state:open
Search results
[Tracker] OpenVuln external audit (2026-08) — security findings remediation
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsIssue TrackerIssue TrackerIssue TrackerP0Critical priority — blocks trust boundary completionCritical priority — blocks trust boundary completionqwed securityqwed securityqwed securitysecuritySecurity finding from adversarial auditSecurity finding from adversarial auditStatus: Open.#342 In QWED-AI/qwed-verification;[Bug] Stats verification chain blocks the event loop: blocking LLM codegen, serialization, un-timeouted Docker daemon calls
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP1High priorityHigh priorityqwed securityqwed securityqwed securityverificationverificationverificationStatus: Open.#341 In QWED-AI/qwed-verification;[Bug] Consensus orchestration runs synchronously on the event loop: cross-tenant DoS + permanent worker-pool exhaustion
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP1High priorityHigh priorityqwed securityqwed securityqwed securityverificationverificationverificationStatus: Open.#340 In QWED-AI/qwed-verification;[Security] Stats sandbox result.json read-back: unbounded host-memory amplification, OOM-kill loops, audit-DB bloat
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP1High priorityHigh priorityqwed securityqwed securityqwed securitysecuritySecurity finding from adversarial auditSecurity finding from adversarial auditverificationverificationverificationStatus: Open.#339 In QWED-AI/qwed-verification;[Security] Sandbox container leaks: unbounded stdout logs, never-removed containers, missing pids_limit
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP1High priorityHigh priorityqwed securityqwed securityqwed securitysecuritySecurity finding from adversarial auditSecurity finding from adversarial auditverificationverificationverificationStatus: Open.#338 In QWED-AI/qwed-verification;[Security] All-tenant metrics readable by any self-service signup (org-scoped role treated as platform authority)
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP1High priorityHigh priorityqwed securityqwed securityqwed securitysecuritySecurity finding from adversarial auditSecurity finding from adversarial auditStatus: Open.#337 In QWED-AI/qwed-verification;[Security] SecureCodeExecutor AST gate bypass via module indirection (pd.io.common.os / posix / importlib)
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP0Critical priority — blocks trust boundary completionCritical priority — blocks trust boundary completionqwed securityqwed securityqwed securitysecuritySecurity finding from adversarial auditSecurity finding from adversarial auditverificationverificationverificationStatus: Open.#336 In QWED-AI/qwed-verification;[Security] Consensus translator multi-statement expression smuggling -> sandbox code execution
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP0Critical priority — blocks trust boundary completionCritical priority — blocks trust boundary completionqwed securityqwed securityqwed securitysecuritySecurity finding from adversarial auditSecurity finding from adversarial auditverificationverificationverificationStatus: Open.#335 In QWED-AI/qwed-verification;[Security] Auth signup/signin bcrypt on event loop: unauthenticated DoS (~4 req/s) + unbounded row growth + brute-force oracle
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP0Critical priority — blocks trust boundary completionCritical priority — blocks trust boundary completionqwed securityqwed securityqwed securitysecuritySecurity finding from adversarial auditSecurity finding from adversarial auditStatus: Open.#334 In QWED-AI/qwed-verification;[Security] Pre-auth PBKDF2 DoS: 100k-iteration hash for any garbage x-api-key stalls event loop / exhausts worker pool
architecturearchitecturearchitecturebugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP0Critical priority — blocks trust boundary completionCritical priority — blocks trust boundary completionqwed securityqwed securityqwed securitysecuritySecurity finding from adversarial auditSecurity finding from adversarial auditStatus: Open.#333 In QWED-AI/qwed-verification;[Security] Math engine compute-cost DoS: factorial/power bombs stall the event loop or OOM-kill the process
bugSomething isn't workingSomething isn't workingexternal-auditFindings from external security auditsFindings from external security auditsP0Critical priority — blocks trust boundary completionCritical priority — blocks trust boundary completionqwed securityqwed securityqwed securitysecuritySecurity finding from adversarial auditSecurity finding from adversarial auditverificationverificationverificationStatus: Open.#331 In QWED-AI/qwed-verification;SDK surface findings from #325 (credit @adhabnr-ux): offline VERIFIED fallback + legacy two-state verify_* paths
architecturearchitecturearchitecturebugSomething isn't workingSomething isn't workingdiagnosticsdiagnosticsdiagnosticsqwed securityqwed securityqwed securitysdkSDK surface (QWEDClient / qwed_sdk)SDK surface (QWEDClient / qwed_sdk)Status: Open.#328 In QWED-AI/qwed-verification;