Issues

[FOLLOW-UP] docker job will fail once build-and-test is unblocked — Dockerfile has no SDK in build context

#234

· dcccrypto opened

on Jul 20, 2026

[BLOCKER] CI cannot install dependencies: lockfile references an unpublished file:../../percolator-sdk

#232

· dcccrypto opened

on Jul 18, 2026

[HIGH-CRITICAL]Bug: Default TRUSTED_PROXY_DEPTH trusts client-supplied X-Forwarded-For, enabling spoofed-IP bypass of HTTP rate limits, IP blocklist, and WebSocket abuse controls

#230

· Bayyan16 opened

on Jun 27, 2026

[MEDIUM] No integrity hash on the @percolator/shared git-tarball dependency in pnpm-lock.yaml

#229

· Morenikeoa opened

on Jun 26, 2026

/chart/:mint cache key includes user-controlled limit parameter — upstream GeckoTerminal amplification

#213

· v1ktorrr0x opened

on Jun 25, 2026

WS auth token is replayable within 5-min window and falls back to empty HMAC secret

#212

· v1ktorrr0x opened

on Jun 25, 2026

Per-IP WS connection cap is a non-atomic read-then-increment (TOCTOU)

#211

· v1ktorrr0x opened

on Jun 25, 2026

WS broadcast loops use raw ws.send — one closing socket aborts the tick for all subscribers

#210

· v1ktorrr0x opened

on Jun 25, 2026

Redis↔in-memory fallback desyncs WS connection counters and auth-bans

#209

· v1ktorrr0x opened

on Jun 25, 2026

IPv6 addresses cannot be blocklisted or auth-banned — no fail-closed behaviour

#208

· v1ktorrr0x opened

on Jun 25, 2026

WebSocket upgrades bypass HTTP rate limiter — unbounded connection churn

#207

· v1ktorrr0x opened

on Jun 25, 2026

CI script injection via repository_dispatch / workflow_dispatch payload

#206

· v1ktorrr0x opened

on Jun 25, 2026

Navigation Menu

All issues

[FOLLOW-UP] docker job will fail once build-and-test is unblocked — Dockerfile has no SDK in build context

[BLOCKER] CI cannot install dependencies: lockfile references an unpublished file:../../percolator-sdk

[HIGH-CRITICAL]Bug: Default TRUSTED_PROXY_DEPTH trusts client-supplied X-Forwarded-For, enabling spoofed-IP bypass of HTTP rate limits, IP blocklist, and WebSocket abuse controls

[MEDIUM] No integrity hash on the @percolator/shared git-tarball dependency in pnpm-lock.yaml

/chart/:mint cache key includes user-controlled limit parameter — upstream GeckoTerminal amplification

WS auth token is replayable within 5-min window and falls back to empty HMAC secret

Per-IP WS connection cap is a non-atomic read-then-increment (TOCTOU)

WS broadcast loops use raw ws.send — one closing socket aborts the tick for all subscribers

Redis↔in-memory fallback desyncs WS connection counters and auth-bans

IPv6 addresses cannot be blocklisted or auth-banned — no fail-closed behaviour

WebSocket upgrades bypass HTTP rate limiter — unbounded connection churn

CI script injection via repository_dispatch / workflow_dispatch payload

Search results