| #1063 |
highway-dsl generator (vm-1 dsl-generator.service): clear provenance findings brotli, certifi, werkzeug, setuptools
EARS SPEC:
- The dsl-generator venv (highway_dsl/app/.venv-uv313) shall contain no package version w...
|
closed |
high |
2026-10-24 22:59 |
- |
|
| #1059 |
Embedded auth tables have no row level security: auth 3.5.1 apply_tenant_rls() not present in highway_db_v2
EARS SPEC:
- While Highway embeds the auth library, the auth_rbac tables shall have RLS enabled and ...
|
open |
high |
2026-10-23 23:05 |
- |
|
| #1050 |
Adopt auth row level security in auth_rbac (creator_fp + tenant_isolation policies) or record why not
EARS (draft):
- Highway shall decide whether to apply auth's creator_fp and RLS migrations (auth rep...
|
open |
medium |
2026-10-22 23:11 |
- |
|
| #1047 |
LLM providers send config/env API keys to a caller-supplied base_url (ollama, OpenAI-compat set, anthropic)
EARS: If a tools.llm.call caller passes base_url and no api_key/api_key_secret_id, then the router s...
|
in-progress |
high |
2026-10-22 22:44 |
- |
|
| #1043 |
Stopgap for #945/#1006: only the platform tenant may publish app versions, and only platform-published versions execute
EARS SPEC:
- If a tenant other than platform calls POST /api/v1/apps (create with its own publisher)...
|
in-progress |
high |
2026-10-22 22:26 |
- |
|
| #1040 |
certifi 2026.7.22 trusts emSign ECC Root CA - G3 (GHSA-6q48-6c7w-9gw2, compromised intermediates); DSL compiler pip-installs caller imports at runtime with pip's vendored certifi
EARS SPEC:
- Every Highway image shall ship certifi >= 2026.10.19 (first patched release; removes em...
|
open |
high |
2026-10-21 22:19 |
- |
|
| #1036 |
A deactivated tenant is not blocked anywhere: no code reads tenant_client_keys.status
EARS SPEC (draft):
- While a tenant's tenant_client_keys.status is 'deactivated', the Highway API sh...
|
closed |
high |
2026-10-20 07:10 |
- |
|
| #1032 |
T0 (#931): agent/session/trigger/automation/agent-run and Gmail/Telegram routes have no permission check; idempotency reset routes delete across tenants
EARS SPEC:
- When a caller who is not a member of tenant T with the required permission calls any /a...
|
in-progress |
critical |
2026-10-20 06:58 |
- |
|
| #1015 |
Tenant-reachable tools: unverified static findings from the #1005 tools.* sweep
STATIC claims from a read-only subagent sweep during #1005. None reproduced; each needs a live repro...
|
in-progress |
high |
2026-10-20 02:52 |
- |
|
| #1014 |
tools.workflow.spawn takes tenant_id from a workflow variable; definition lookups by name/id are not tenant-scoped
EARS: tools.workflow.spawn shall submit the child under ctx.tenant_id only. get_latest_definition an...
|
in-progress |
critical |
2026-10-20 02:52 |
- |
|
| #1013 |
Tenant users can list, pause, drain, resize and delete shared platform workers (/api/v1/workers*)
EARS: The worker list and worker control endpoints shall be available only to platform admins (requi...
|
in-progress |
high |
2026-10-20 02:52 |
- |
|
| #1012 |
Bad caller input that reaches SQL returns 500 instead of 400
EARS: If request parameters are invalid (e.g. /workflows/stats?since=garbage), then the API shall re...
|
in-progress |
medium |
2026-10-20 02:38 |
- |
|
| #1011 |
Global ValueError handler echoes exception text to clients
EARS: If an unhandled ValueError reaches the API error handler, then the response shall carry a stab...
|
in-progress |
medium |
2026-10-20 02:38 |
- |
|
| #1010 |
gateway_approvals.py renders error text into HTML without escaping (XSS)
EARS: When the approval gateway renders an HTML page, every interpolated value shall be HTML-escaped...
|
in-progress |
high |
2026-10-20 02:38 |
- |
|
| #1009 |
schedules.py imports a module named by the caller
EARS: When a schedule is created or run, the API/engine shall never import a module whose name comes...
|
in-progress |
high |
2026-10-20 02:38 |
- |
|
| #1008 |
POST /api/v1/dsl_to_json executed caller Python on the API container (AST blocklist only)
EARS SPEC:
- When POST /api/v1/dsl_to_json converts Python DSL, the API shall run the code only in t...
|
open |
critical |
2026-10-20 02:38 |
- |
|
| #1006 |
App child processes inherit the worker environment; pathlib/io are allowlisted, so app code can likely read /proc/self/environ and /run/highway/secrets
EARS SPEC:
- When an app action runs in its child process, the child shall hold no worker secret in ...
|
open |
high |
2026-10-20 02:26 |
- |
|
| #1005 |
Tenant workflows can run internal.* tools: the submit-time internal tool block is never called
EARS SPEC:
- If a workflow submitted through POST /api/v1/workflows (or any tenant-facing submit pat...
|
in-progress |
critical |
2026-10-20 02:26 |
- |
|
| #994 |
Unsandboxed shell tasks inherit the full worker environment (DB_PASSWORD, keys, Vault token)
EARS SPEC:
- When a shell or code task runs outside the sandbox, the engine shall pass it only an ex...
|
in-progress |
high |
2026-10-20 01:19 |
- |
|
| #991 |
CRITICAL: {{ENV.<name>}} in workflow templates returns any worker environment variable (DB_PASSWORD, JWT secret, encryption keys, Vault admin token)
EARS SPEC:
- The variable resolver shall not resolve any reference to the worker process environment...
|
open |
critical |
2026-10-20 01:11 |
- |
|