2026-02-12 - 2026-08-12
Overview
13 Pull requests merged by 2 users
Merged
#29 Update golangci-lint to v2.12.2 with canonical config
Merged
#28 Add .editorconfig (closes #27)
Merged
#26 scripts-to-rule-them-all
Merged
#25 TODO
Merged
#21 ci: add Gitea Actions workflow for make check
Merged
#24 secure-enclave-unlocker
Merged
#22 chore: remove stale .cursorrules and coverage.out
Merged
#20 Add secret.Warn() calls for all silent anomalous conditions
Merged
#17 Skip unlocker directories with missing metadata instead of failing (closes #1)
Merged
#8 Fix getLongTermPrivateKey derivation index hardcoded to 0 (closes #3)
Merged
#16 Allow uppercase letters in secret names (closes #2)
Merged
#15 Validate secret name in GetSecretVersion to prevent path traversal (closes #13)
Merged
#18 Return error from GetDefaultStateDir when home directory unavailable (closes #14)
1 Pull request proposed by 1 user
Proposed
#53 Make script/test fail on flaky failures and enable -race (closes #32)
11 Issues closed from 2 users
Closed
#45 script/bootstrap installs golangci-lint unpinned, so local lint diverges from CI
Closed
#30 Adopt canonical .golangci.yml and golangci-lint v2.12.2
Closed
#31 Decision needed: three commits on main carry vendor advertising trailers
Closed
#27 Add .editorconfig
Closed
#23 Add branch protection to main branch
Closed
#19 Audit: missing user warnings for anomalous conditions
Closed
#1 missing metadata file for single unlocker breaks 'list' command
Closed
#3 Bug: getLongTermPrivateKey hardcodes derivation index 0 for mnemonic path
Closed
#2 secret name validation is wrong
Closed
#13 Bug: GetSecret/GetSecretVersion missing name validation allows path traversal
Closed
#14 Bug: GetDefaultStateDir ignores UserHomeDir error, may use empty path
30 Issues created by 1 user
Opened
#14 Bug: GetDefaultStateDir ignores UserHomeDir error, may use empty path
Opened
#13 Bug: GetSecret/GetSecretVersion missing name validation allows path traversal
Opened
#19 Audit: missing user warnings for anomalous conditions
Opened
#23 Add branch protection to main branch
Opened
#27 Add .editorconfig
Opened
#30 Adopt canonical .golangci.yml and golangci-lint v2.12.2
Opened
#31 Decision needed: three commits on main carry vendor advertising trailers
Opened
#32 script/test silently passes on flaky failures, and runs without -race or -timeout
Opened
#33 Critical: secret rm .. deletes the entire vault; rm/mv/import skip name validation
Opened
#34 No file locking and no atomic writes: concurrent or interrupted operations corrupt the vault
Opened
#35 memguard lifecycle is not wired up: Ctrl-C and error exits leave key material in locked memory unwiped
Opened
#36 KeychainData holds the age key passphrase as a plain string through JSON marshalling
Opened
#37 GetSecretVersion copies decrypted secrets out of locked memory into plain []byte
Opened
#38 age identity .String() creates unprotected copies of private keys at six call sites
Opened
#39 No confirmation prompt on any destructive operation
Opened
#40 .gitignore does not exclude secrets, and .dockerignore does not exclude .git
Opened
#41 Cobra prints full usage on internal failures, burying the actual error
Opened
#42 PGPUnlocker.GetID panics on corrupt metadata, and setMnemonicEnv re-exports the mnemonic
Opened
#43 Go module path is git.eeqj.de/sneak/secret, policy requires sneak.berlin/go/secret
Opened
#44 Makefile hardcodes a personal remote DOCKER_HOST, breaking make docker for everyone else
Opened
#45 script/bootstrap installs golangci-lint unpinned, so local lint diverges from CI
Opened
#46 README missing four required sections; TODO.md is stale and describes completed work as pending
Opened
#47 Error messages leak internals and offer no recovery path for corrupted key files
Opened
#48 CreatePGPUnlocker leaves a partial unlocker directory on disk when fingerprint resolution fails
Opened
#49 Tests assert on error message fragments, never on sentinel identity — error-handling regressions pass silently
Opened
#50 Darwin-only code is never compiled, linted, or tested by CI, including both hardware-backed unlockers
Opened
#51 checkUnlockerExists fails open: an unenumerable unlockers.d reports "no duplicate" and permits a duplicate unlocker
Opened
#52 Test suite cannot meet the 20s policy budget once -race is enabled: internal/cli 100MB boundary tests
Opened
#54 script/cibuild can report a cached green: docker build serves RUN make check layers from cache
Opened
#55 Run all linting in Docker via Dockerfile.lint + script/lint