Go to issue

Labels Milestones New Issue

2 Open 1 Closed

Label

Show archived labels Use alt + click/enter to exclude labels

All labels No label

BETA-CRITICAL

blocks-public-beta

HELD

ORTHOGONAL

P0

POST-BETA

security

Milestone

All milestones No milestones

Project

All projects No project

Author

All users

Assignee

Assigned to nobody Assigned to anybody

andre.almeida (Andre Almeida) tim.lingo (Tim Lingo) will.anderson (Will Anderson)

Sort

Newest Oldest Most recently updated Least recently updated Most commented Least commented Nearest due date Farthest due date

2 Open 1 Closed

Close

Label

Clear labels

BETA-CRITICAL

blocks-public-beta

HELD

ORTHOGONAL

P0

POST-BETA

security

Milestone

No milestone

Projects

Clear projects

Assignee

Clear assignees

No assignee

andre.almeida

tim.lingo

will.anderson

[P0][SECURITY] Unauthenticated LAN + unfenced /api/tools/file/write = remote arbitrary file write (escalates #110) blocks-public-beta P0 security

#128 opened 2026-08-07 03:13:35 +00:00 by tim.lingo

1

[P0][SECURITY] BUG-41: shipped brain binds ALL interfaces with no auth — the launcher's loopback-lock and auth key are inert (EL_HTTP_BIND_HOST / EL_HTTP_AUTH_KEY exist nowhere in the engine) BETA-CRITICAL blocks-public-beta P0 security

#110 opened 2026-08-06 03:24:24 +00:00 by tim.lingo

1