| #427 |
App: AI Document Summarizer (doc_summarizer)
## Overview
Summarize documents and web pages using LLM, with email delivery of results.
## App Met...
|
open |
high |
2025-12-14 20:14 |
- |
|
| #426 |
App: URL Health Monitor (health_monitor)
## Overview
Monitor website/API uptime with scheduled checks and email alerts on failures.
## App M...
|
closed |
high |
2025-12-14 20:13 |
- |
|
| #410 |
ARTIFACT mode in code_versioning doesn't auto-load from code_artifacts table
Review Gap 3 incomplete: CodeVersionMode.ARTIFACT is defined but python_task.py doesn't auto-load co...
|
closed |
high |
2025-12-12 06:11 |
- |
|
| #407 |
HTTP Idempotency-Key auto-injection for exactly-once semantics
Review Gap 1: Side-Effect Atomicity. HTTP requests in tools.http.request execute BEFORE transaction ...
|
closed |
high |
2025-12-12 06:06 |
- |
|
| #397 |
HIGH: Predictable /tmp file path TOCTOU vulnerability in async_deferred_task
async_deferred_task.py:103-105 - Creates predictable /tmp/highway_job_{job_id}.py file path. Attacke...
|
closed |
high |
2025-12-11 22:44 |
- |
|
| #390 |
HIGH: Unsafe getattr() on user-controlled attribute names
variable_resolver.py:314-315 - Uses getattr() with user-controlled segment names. Could expose inter...
|
closed |
high |
2025-12-11 22:21 |
- |
|
| #389 |
HIGH: NOTIFY SQL injection via unsanitized channel/payload
durable_context.py:1683-1698 - NOTIFY uses f-string: cur.execute(f"NOTIFY \"{channel}\", '{payload}'...
|
closed |
high |
2025-12-11 22:21 |
- |
|
| #388 |
HIGH: Race condition in RBAC ClientKeyManager cache (no thread lock)
rbac_manager.py:91-135 - ClientKeyManager._cache is plain dict without thread locks. Comment claims ...
|
closed |
high |
2025-12-11 22:21 |
- |
|
| #387 |
HIGH: Shell command circuit breaker cache lacks TTL (memory leak)
shell_command.py:87-150 - Circuit breaker cache has no TTL or max size, unlike http_request.py which...
|
closed |
high |
2025-12-11 22:21 |
- |
|
| #386 |
HIGH: time.sleep() in retry logic blocks event loop and is non-deterministic
operators.py:116-119 - Retry delay uses synchronous time.sleep() which blocks and is non-determinist...
|
closed |
high |
2025-12-11 22:21 |
- |
|
| #377 |
HIGH: WaitOperator uses non-deterministic datetime.now()
operators.py:989 uses datetime.now(timezone.utc) to calculate wake_at. On replay, different wake tim...
|
closed |
high |
2025-12-11 21:54 |
- |
|
| #376 |
HIGH: ForEach results lost on resume
operators.py:601-624 - Resumed ForEach loops reinitialize results=[]. Previously completed iteration...
|
closed |
high |
2025-12-11 21:54 |
- |
|
| #375 |
HIGH: SQL injection pattern in platform.py tenant deletion
platform.py:1083-1121 uses f-strings for table names in DELETE queries. Should use psycopg.sql.Ident...
|
closed |
high |
2025-12-11 21:54 |
- |
|
| #374 |
HIGH: Shell command injection via unescaped variables
shell_command.py:278-281 resolves variables and passes directly to shell=True subprocess. If {{user_...
|
closed |
high |
2025-12-11 21:54 |
- |
|
| #366 |
HIGH: TenantCache TTL creates stale tenant resolution
## Issue
TenantCache in engine/orchestrator.py:55-110 has 5-minute TTL. If a workflow run is delete...
|
closed |
high |
2025-12-11 21:39 |
- |
|
| #365 |
HIGH: Global determinism state shared across workflows
## Issue
Global flags in engine/durable_context.py:39-43 are NOT thread-safe and shared across all ...
|
closed |
high |
2025-12-11 21:39 |
- |
|
| #364 |
HIGH: ForEach/While loop checkpoints not persisted to database
## Issue
ForEach and While loop operators save checkpoints to ctx._checkpoints_cache but do NOT cal...
|
closed |
high |
2025-12-11 21:39 |
- |
|
| #359 |
ForEach operator runs sequentially, not in parallel
## Problem
The ForEachOperator in engine/interpreters/operators.py:614 uses a sequential for loop:
...
|
closed |
high |
2025-12-11 09:00 |
- |
|
| #358 |
Implement storage tool with S3 backend and user upload capability
## Summary
Implement a new `storage` tool that enables workflows to:
1. Store workflow-generated fi...
|
closed |
high |
2025-12-11 06:12 |
- |
|
| #357 |
code_executor: Use Docker sandbox with auto-detection
## Issue
code_executor.py and shell_command.py run untrusted code without sandboxing.
## Sandbox Im...
|
closed |
high |
2025-12-10 08:31 |
- |
|