Block a user
The request metrics label every distinct URL path, so unauthenticated requests grow memory without bound when metrics are on
A source whose first bytes do not match its Content-Type answers 500 and is fetched again on every request
A cached file left empty or partial by a crash is served or re-fetched forever
The upaas section calls the cache size limit optional, but its default takes three quarters of a shared filesystem
The reconciliation pass costs one database query per cached file and runs back to back on a large cache
The example config allowlists public hosts that carry anyone's uploads
A chunked upstream body of exactly the maximum size is refused
The signed data and the cache key are ambiguous between path and query
A cached variant is refused while its source URL is in the negative cache
The host segment is not normalized before the allowlist, the per-host limit and the cache keys
Negative-cache rows are never purged, so the database grows without bound
Image processing runs past the request's deadline and keeps its slot
Memory per image and the default number of images processed at once are not bounded or documented for the container
A request with one dimension 0 makes an output of unbounded size
Count a file as deleted only if the previous snapshot of its name had it
internal/snapshot/scanner.go,detectDeletedFiles: a file counts as excluded only when an exclude pattern matches its own path, but the walk also skips everything inside an excluded…
clawbot
deleted branch issue-295-remote-info-non-blob-files from sneak/vaultik
2026-10-13 08:33:29 +02:00
remote info counts a file under blobs/ that is not a blob as an orphaned blob