-
-
Notifications
You must be signed in to change notification settings - Fork 1
All issues
Issue creation is restricted in this repository
Issues
is:issue state:open
is:issue state:open
Search results
[Bug]: Provenance download-count heuristics block every new legitimate skill and every ÷1000 count while attackers pick 11 or 1001
bugSomething isn't workingSomething isn't workingStatus: Open.#47 In QWED-AI/qwed-mcp;[Bug]: CI actions tag-pinned instead of SHA-pinned (checkout@v4, setup-python@v5, publish@release/v1, docker actions) — only unpinned repo in the ecosystem
bugSomething isn't workingSomething isn't workingStatus: Open.#46 In QWED-AI/qwed-mcp;[Bug]: README sells "deterministic verification" but the registered tools are code-exec + a status poller — engines unreachable from MCP surface; settle the engines' fate
documentationImprovements or additions to documentationImprovements or additions to documentationenhancementNew feature or requestNew feature or requestStatus: Open.#45 In QWED-AI/qwed-mcp;[Bug]: Five runtime dependencies never imported (qwed-finance, qwed-ucp, httpx, PyJWT, cryptography) — pure supply-chain surface
bugSomething isn't workingSomething isn't workingStatus: Open.#44 In QWED-AI/qwed-mcp;[Bug]: Gateway labels denylist scan-clean as ALLOW_VERIFIED / "passed deterministic verification" — false verification claim in the decision vocabulary
bugSomething isn't workingSomething isn't workingStatus: Open.#43 In QWED-AI/qwed-mcp;[Bug]: SQL engine flags all '--' line comments as injection — false positives erode boundary trust
bugSomething isn't workingSomething isn't workingStatus: Open.#31 In QWED-AI/qwed-mcp;[Bug]: Provenance digest is format-checked but never content-verified — false integrity assurance
bugSomething isn't workingSomething isn't workingStatus: Open.#30 In QWED-AI/qwed-mcp;[Bug]: track_verification is dead code — Sentry security-event layer never fires for blocked decisions
bugSomething isn't workingSomething isn't workingStatus: Open.#29 In QWED-AI/qwed-mcp;[Bug]: Unbounded background job queue — pending_verifications has no depth cap (memory DoS)
bugSomething isn't workingSomething isn't workingStatus: Open.#28 In QWED-AI/qwed-mcp;[Bug]: SQL allowed_tables bypass — quoted/schema-qualified identifiers extract nothing, compliance check fails open
bugSomething isn't workingSomething isn't workingStatus: Open.#27 In QWED-AI/qwed-mcp;[Bug]: Logic engine 'is'/'is not' patterns silently drop RHS operand — returns verified=True for rewritten premises
bugSomething isn't workingSomething isn't workingStatus: Open.#26 In QWED-AI/qwed-mcp;[Bug]: Resource exhaustion through approved parser boundary — eager Pow/factorial evaluation (CWE-400 family of GHSA-mw6r-2hvm-4rp2)
bugSomething isn't workingSomething isn't workingStatus: Open.#25 In QWED-AI/qwed-mcp;