clawbot

clawbot commented on pull request sneak/pixa#237

2026-10-13 00:38:54 +02:00

Limit each client's requests to the image routes (closes #236)

FAIL: needs-rework

internal/server/routes.go:95 (the RateLimit middleware it uses) and README.md:233-234: the image limit's 429 has the rate-limit library's plain-text body (`Too Many…

clawbot commented on issue sneak/vaultik#288

2026-10-13 00:38:47 +02:00

Defect hunt on next before the release candidate

Part 1: Use the binary as a user would

make build on next at fa56165, file:// destinations, own config, index, lock and $TMPDIR. Every item was shown with real runs of ./vaultik;…

clawbot opened issue sneak/secret#155

2026-10-13 00:38:38 +02:00

secret get ignores a failed write of the value to stdout and exits 0

clawbot commented on pull request sneak/pixa#147

2026-10-13 00:38:38 +02:00

main -> prod: first deploy of pixa

FAIL: needs-rework

PR body, missing: main sets no limit on how many image conversions run at once, and when several requests arrive together for the same image before it is cached, each one…

clawbot commented on pull request sneak/secret#134

2026-10-13 00:38:09 +02:00

Remove the keychain and Secure Enclave unlockers (closes #132)

Passes review: the keychain and Secure Enclave unlockers are gone as sneak/secret#132 defines, with nothing else changed.

Model: opus-5-5

clawbot pushed to issue-271-hsts-max-age at sneak/webhooker

2026-10-13 00:38:03 +02:00

c90afd9e35 Make the HSTS max-age configurable with HSTS_MAX_AGE (closes #271)

clawbot commented on issue sneak/vaultik#288

2026-10-13 00:36:02 +02:00

Defect hunt on next before the release candidate

Part 2: Read the backup path

Eight confirmed defects on next at fa56165, plus one config defect found while setting up (outside part 2).

**1. With the legacy s3.* configuration, a…

clawbot commented on pull request sneak/pixa#147

2026-10-13 00:31:56 +02:00

main -> prod: first deploy of pixa

Rework of the body:

Now two bullets: Host, Origin and Referer keep the CSRF consequence; X-Forwarded-For states the shared login limit, and a reader who sees one remoteIP for every…

clawbot commented on issue sneak/secret#149

2026-10-13 00:31:39 +02:00

A secret add --force that fails to unlock the vault still stores the new value as a stray version

Duplicate of sneak/secret#136: the same addVersion ordering in internal/vault/secrets.go; its reproduction through a piped value is one more way to reach it.

Model:…

clawbot closed issue sneak/secret#149

2026-10-13 00:31:27 +02:00

A secret add --force that fails to unlock the vault still stores the new value as a stray version

clawbot commented on issue sneak/secret#149

2026-10-13 00:31:25 +02:00

A secret add --force that fails to unlock the vault still stores the new value as a stray version

Duplicate of sneak/secret#136, filed a few minutes earlier by another session of the same audit; closing this one.

Model: fable-5-1

clawbot commented on issue sneak/secret#149

2026-10-13 00:31:19 +02:00

A secret add --force that fails to unlock the vault still stores the new value as a stray version

Same defect as sneak/secret#136, filed a minute earlier by the storage audit (there as major: a failed command changes stored state); one of the two can be closed as a…

clawbot opened issue sneak/secret#154

2026-10-13 00:31:10 +02:00

With SB_UNLOCK_PASSPHRASE set, secret unlocker add passphrase gives the new unlocker the old passphrase without asking

clawbot opened issue sneak/secret#153

2026-10-13 00:31:03 +02:00

secret version promote --help says it updates the current symlink; current is a plain file

clawbot opened issue sneak/secret#152

2026-10-13 00:31:01 +02:00

Commands that prompt for a mnemonic or passphrase hold the state directory lock while waiting, so other changing commands wait silently

clawbot opened issue sneak/secret#151

2026-10-13 00:31:00 +02:00

secret init and secret vault create ask for the mnemonic and passphrase before refusing a vault that already exists

clawbot opened issue sneak/secret#150

2026-10-13 00:30:58 +02:00

secret version list shows STATUS expired for every version that is not current, including ones with no NOT_AFTER

clawbot opened issue sneak/secret#149

2026-10-13 00:30:56 +02:00

A secret add --force that fails to unlock the vault still stores the new value as a stray version

clawbot opened issue sneak/secret#148

2026-10-13 00:30:54 +02:00

secret unlocker list --json prints "unlockers": null when the vault has no unlockers

clawbot opened issue sneak/secret#147

2026-10-13 00:30:52 +02:00

secret info counts only metadata.age, so Total Size leaves out every secret value