Go to issue

Labels Milestones New Issue

48 Open 34 Closed

Label

Show archived labels Use alt + click/enter to exclude labels

All labels No label

merge-ready

needs-checks

needs-rebase

needs-review

needs-rework

Milestone

All milestones No milestones

Open milestones

1.0.0

Project

All projects No project

Author

All users

Assignee

Assigned to nobody Assigned to anybody

clawbot sneak (Jeffrey Paul)

Sort

Newest Oldest Most recently updated Least recently updated Most commented Least commented Nearest due date Farthest due date

48 Open 34 Closed

Open

Label

Clear labels

merge-ready

needs-checks

needs-rebase

needs-review

needs-rework

Milestone

No milestone

Open milestones

1.0.0

Projects

Clear projects

Assignee

Clear assignees

clawbot

sneak

Docker image bakes the example config with a placeholder signing key; take the key from the environment and refuse the placeholder

#110

by clawbot was closed 2026-09-21 21:59:25 +02:00

1.0.0

2

Prove the Docker lint gate actually lints: defeat layer cache + negative control

#108

by clawbot was closed 2026-09-05 11:32:53 +02:00

1.0.0

1

Add hash-pinned Dockerfile.lint and make script/lint Docker-only

#107

by clawbot was closed 2026-09-05 11:32:53 +02:00

1.0.0

1

TODO.md documents a branch-from-main workflow that no longer matches the next branching model

#106

by clawbot was closed 2026-09-21 19:59:52 +02:00

1.0.0

Blocks 1.0: no trusted-proxy handling — every log line and login record shows the proxy's IP

#94

by clawbot was closed 2026-09-22 10:25:42 +02:00

1.0.0

4

Blocks 1.0: no CSRF protection on the cookie-authenticated POST / and POST /generate forms

#93

by clawbot was closed 2026-09-21 19:26:19 +02:00

1.0.0

Blocks 1.0: http.Server missing IdleTimeout and ReadHeaderTimeout (slowloris), no request body size limits

#92

by clawbot was closed 2026-09-21 20:59:26 +02:00

1.0.0

2

Blocks 1.0: missing HSTS, CSP, and Permissions-Policy security headers

#91

by clawbot was closed 2026-09-21 20:43:14 +02:00

1.0.0

2

httpfetcher: redirect-to-private-IP SSRF and semaphore release are untested

#78

by clawbot was closed 2026-09-21 19:59:27 +02:00

1.0.0

1

P1: blocked networks config + SSRF gaps (CGNAT, benchmark, NAT64 ranges not blocked)

#67

by clawbot was closed 2026-09-22 00:43:28 +02:00

1.0.0

2

script/test doesn't follow the REPO_POLICIES conditional-verbose-rerun pattern (always runs -v)

#59

by clawbot was closed 2026-09-21 19:43:22 +02:00

1.0.0

1

script/lint does not pin the golangci-lint binary version, so local runs can false-green against a stale linter

#58

by clawbot was closed 2026-08-10 16:13:10 +02:00

1.0.0

3

P0: validate configuration on startup, fail fast on bad config

#52

by clawbot was closed 2026-08-07 22:39:40 +02:00

2

P0: implement cache size management and eviction

#51

by clawbot was closed 2026-08-09 13:22:51 +02:00

1.0.0

3

P0: manual test pass of the auth and encrypted URL flows

#49

by clawbot was closed 2026-08-07 18:44:01 +02:00

2

Fix remaining gosec lint findings on main

#47

by clawbot was closed 2026-08-07 17:41:03 +02:00

3

imageprocessor.Process appears to do unbounded read into memory

#31

by sneak was closed 2026-03-20 07:01:15 +01:00

1

Appname doesn’t need to be in main and internal/globals both

#30

by sneak was closed 2026-03-20 09:38:44 +01:00

1

000.initial.sql should contain migrations table schema

#29

by sneak was closed 2026-03-25 02:20:53 +01:00

migrations need to parse version out of filename

#28

by sneak was closed 2026-03-18 03:18:39 +01:00