Search results

ANNOTATION_VOCABULARY drops silently — same defect has recurred 4 times; add a usage-derived guard

Status: Open.

#2168 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 27, 2026

github credential provider allowRules permit no issue-label write — blocks all label-driven forge automation

Status: Open.

#2165 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 27, 2026

Flow nodes cannot see their step id or onError policy — execute() receives step['config'], not the step

Status: Open.

#2163 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 27, 2026

RBAC subject on write paths comes from the session, not an explicit acting user — sessionless flow runs authorise as anonymous

Status: Open.

#2162 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 27, 2026

openregister.runFlow: no parameter channel and no ADR-063 hints

Status: Open.

#2159 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 27, 2026

FlowMcpToolProvider::runFlow drops the acting user — agent-dispatched flow runs are unattributed

Status: Open.

#2158 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 27, 2026

dbal-source: single-object GET with non-numeric id against integer-pk table returns 502 instead of 404

Status: Open.

#2157 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026

MetricsService::recordMetric fails on nearly every object write — 'Only strings, Literals and Parameters are allowed'

Status: Open.

#2153 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026

security(info-disclosure): ArchivalController::getDestructionList returns 500 (SQL leak) for unknown id instead of 404

Status: Open.

#2146 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026

RegistersController::show() 500s with HTML error page on unknown id/uuid/slug instead of a clean 404

Status: Open.

#2144 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026

OpenRegister self-dogfooded /api/health and /api/metrics were 503ing (App controller is not enabled)

Status: Open.

#2143 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026

security(rbac): IDOR — findAcrossAllMagicTables ignores _rbac/_multitenancy on cross-schema UUID fallback

Status: Open.

#2137 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026