Issues 28 open · 331 closed

● #240 Trusted timestamps for signatures (from the transparency log, or RFC 3161) security

opened 19 days ago by andymccall · 4 comments

● #239 Standard exports: cosign-verifiable releases, in-toto/SLSA provenance in DSSE feature

opened 19 days ago by andymccall · 3 comments

● #238 A transparency log: append-only, witnessed, so the hub cannot show different histories security

opened 19 days ago by andymccall · 3 comments

● #237 Approve from the web with a passkey delegated by your Oxygen identity security

opened 19 days ago by andymccall

● #236 Follow a key rotation chain when checking who signed (approvals, seals) feature

opened 19 days ago by andymccall

● #235 Sealed approvals: cryptographic proof of who approved a gated job security

opened 19 days ago by andymccall

● #234 A local cache for repositories kept in GCS (or S3): pages on them take seconds performance

opened 19 days ago by andymccall · 1 comment

● #233 A deploy restart cuts off requests in flight: drain them bug

opened 19 days ago by andymccall · 2 comments

● #232 Checks panel overflows with a long check summary bug

opened 19 days ago by andymccall

● #231 HSTS, staged: 5 minutes, then a week, then a year security

opened 20 days ago by andymccall

● #230 A security contact page at /security-contact security

opened 20 days ago by andymccall

● #229 Approvals made with an agent token should say so (and may need to be refused) security

opened 20 days ago by andymccall · 2 comments

● #228 negotiate on a large repository takes ~7 s per request; one client polling it keeps the hub busy performance

opened 20 days ago by andymccall · 3 comments

● #227 Move inline scripts and handlers into hub.js so the CSP can be enforced security

opened 20 days ago by andymccall · 3 comments

● #226 A change that closes several issues closes only the first buggap

opened 20 days ago by andymccall

● #225 Users with their own runners can switch Flow on for their repositories featuregap

opened 20 days ago by andymccall

● #224 Security (info): publish security.txt featuresecurity

opened 20 days ago by andymccall

● #223 Security (low): sessions are long-lived and cannot be revoked one by one featuresecurity

opened 20 days ago by andymccall

● #222 Security (medium): baseline browser security headers featuresecurity

opened 20 days ago by andymccall

● #221 Security (medium): no login throttling featuresecurity

opened 20 days ago by andymccall

● #220 Security (medium): webhook responses have no size limit bugsecurity

opened 20 days ago by andymccall

● #219 Security (high): SSRF through webhook and assistant URLs bugsecurity

opened 20 days ago by andymccall

● #218 Security (critical): plain HTTP served without redirecting to HTTPS bugsecurity

opened 20 days ago by andymccall · 1 comment

● #217 Profile: the year as a signal (contribution pulse) featureui

opened 20 days ago by andymccall

● #216 Proposal changes list: state addresses in Diffusion bump titles run off the page bugui

opened 20 days ago by andymccall