Go to issue

Labels Milestones New Issue

67 Open 155 Closed

Label

Show archived labels Use alt + click/enter to exclude labels

All labels No label

merge-ready

needs-checks

needs-rebase

needs-review

needs-rework

Milestone

All milestones No milestones

Open milestones

1.0.0

Project

All projects No project

Author

All users

Assignee

Assigned to nobody Assigned to anybody

clawbot sneak (Jeffrey Paul)

Sort

Newest Oldest Most recently updated Least recently updated Most commented Least commented Nearest due date Farthest due date

67 Open 155 Closed

Close

Label

Clear labels

merge-ready

needs-checks

needs-rebase

needs-review

needs-rework

Milestone

No milestone

Open milestones

1.0.0

Projects

Clear projects

Assignee

Clear assignees

clawbot

sneak

harden: runtime debug mode logs full request URLs and bodies, which can include RPC credentials

#410

opened 2026-09-21 20:37:57 +02:00 by clawbot

0 / 3

decision: eth_sign is signed as a personal message while its warning and the README describe raw-hash signing

#409

opened 2026-09-21 20:37:57 +02:00 by clawbot

0 / 3

decision: a connected site can switch the wallet's network with no prompt

#408

opened 2026-09-21 20:37:56 +02:00 by clawbot

0 / 2

harden: origin attribution falls back to the top-level tab URL and then to the page-supplied origin

#407

opened 2026-09-21 20:37:56 +02:00 by clawbot

0 / 3

harden: a session (non-remembered) site connection cannot be revoked from the UI, and the remove-site message does nothing

#406

opened 2026-09-21 20:37:56 +02:00 by clawbot

0 / 3

harden: a page can open unbounded concurrent approval windows

#405

opened 2026-09-21 20:37:56 +02:00 by clawbot

0 / 3

harden: a page-supplied transaction nonce is honoured and shown only as a bare number

#404

opened 2026-09-21 20:37:56 +02:00 by clawbot

0 / 2

harden: personal_sign display decodes only hex and renders control and bidirectional characters verbatim, without the raw bytes

#403

opened 2026-09-21 20:37:56 +02:00 by clawbot

0 / 4

harden: remembered site permissions are keyed by hostname only, dropping the scheme and port

#402

opened 2026-09-21 20:37:56 +02:00 by clawbot

0 / 4

decision: Argon2id runs at INTERACTIVE cost for the at-rest vault key

#401

opened 2026-09-21 20:37:56 +02:00 by clawbot

1.0.0 0 / 3

harden: typed-data signing shows no warning for allowance-granting shapes and displays a primaryType it does not enforce

#400

opened 2026-09-21 20:37:56 +02:00 by clawbot

1.0.0 0 / 3

security: the EIP-6963 provider UUID is persisted and reused, so any site can read a stable per-install tracking identifier

#398

opened 2026-09-21 20:37:56 +02:00 by clawbot

1.0.0 0 / 4

1

infra: the mac-studio CI runner has run out of docker subnets, so every e2e job fails before checkout

#396

opened 2026-09-21 09:56:29 +02:00 by clawbot

0 / 2

1

decision: how 1.0.0 is distributed on Firefox (signing) and on Chrome (store or CRX)

#386

opened 2026-09-21 09:19:21 +02:00 by clawbot

1.0.0 0 / 3

verify: a human pass against a real network with real funds before the 1.0.0 tag

#385

opened 2026-09-21 09:19:11 +02:00 by clawbot

1.0.0 0 / 9

release: bump the version to 1.0.0 in package.json and both manifests, as the last unit of the milestone

#384

opened 2026-09-21 09:19:11 +02:00 by clawbot

1.0.0 0 / 4

security: pre-1.0 review of key handling, DEBUG mode and RPC/dApp input validation

#383

opened 2026-09-21 09:19:11 +02:00 by clawbot

1.0.0 0 / 4

1

Review toward 1.0: identify and file all next steps

#382

opened 2026-09-21 09:13:44 +02:00 by clawbot

4

test: classes of undriven path in the persisted-field contract harness

#379

opened 2026-08-23 22:45:08 +02:00 by clawbot

0 / 5

1

chore: the toolbar icons ship as opaque binaries with no in-tree way to regenerate them

#378

opened 2026-08-23 21:26:29 +02:00 by clawbot

0 / 4