| #513 |
[ENGINE/Race] Sidecar telemetry singleton __init__ race
**File:** engine/sidecar_telemetry.py:74-81
**Problem:** Singleton pattern with __new__ but attribu...
|
closed |
medium |
2025-12-17 14:59 |
- |
|
| #512 |
[ENGINE/Race] Tenant config cache snapshot TOCTOU race
**File:** engine/config.py:640-661
**Problem:** TOCTOU between cache snapshot and cleanup - another...
|
closed |
high |
2025-12-17 14:58 |
- |
|
| #511 |
[ENGINE/Race] Circuit breaker storage singleton missing lock
**File:** engine/config.py:337-365
**Problem:** Missing lock for singleton initialization. Two thre...
|
closed |
high |
2025-12-17 14:58 |
- |
|
| #510 |
[ENGINE/Memory] Vault secret cache entries never proactively removed
**File:** engine/config.py:82-83
**Problem:** Cache entries are checked for expiration on read but ...
|
closed |
high |
2025-12-17 14:58 |
- |
|
| #509 |
[ENGINE/Memory] Unbounded tenant config cache cleanup
**File:** engine/config.py:593-610
**Problem:** The tenant config cache can grow unbounded if tenan...
|
closed |
high |
2025-12-17 14:58 |
- |
|
| #508 |
Race: Rate limiter TOCTOU
api/middleware/rate_limiter.py:22-47 - check_quota and get_tenant_stats in separate calls. Stats may...
|
closed |
low |
2025-12-17 02:58 |
- |
|
| #507 |
Memory: Workflow graph recursion no limit
api/blueprints/v1/workflows.py:1283-1307 - _extract_all_tasks recursion has no depth limit. Maliciou...
|
closed |
medium |
2025-12-17 02:58 |
- |
|
| #506 |
Performance: Constant list should be tuple (tasks.py)
api/blueprints/v1/tasks.py:23 - QUEUES is mutable list. FIX: Use tuple for immutability.
|
closed |
low |
2025-12-17 02:58 |
- |
|
| #505 |
Performance: Constant list should be tuple (apps.py)
api/blueprints/v1/apps.py:158-167 - valid_categories is mutable list. FIX: Use tuple or frozenset fo...
|
closed |
low |
2025-12-17 02:57 |
- |
|
| #504 |
Performance: List instead of frozenset for membership (validators)
api/middleware/validators.py:123 - valid_statuses is list, O(n) lookup. FIX: Use frozenset for O(1).
|
closed |
low |
2025-12-17 02:57 |
- |
|
| #503 |
Performance: Import inside function (workflows.py)
api/blueprints/v1/workflows.py:77 - 'import re' inside convert_python_dsl_to_json function. FIX: Mov...
|
closed |
low |
2025-12-17 02:57 |
- |
|
| #502 |
Performance: Regex not pre-compiled (DSL main block)
api/blueprints/v1/workflows.py:81-86 - re.sub() with inline pattern on every DSL conversion. FIX: Pr...
|
closed |
low |
2025-12-17 02:57 |
- |
|
| #501 |
Performance: Regex not pre-compiled (app_name)
api/blueprints/v1/apps.py:147 - re.match() with inline pattern on every app creation. FIX: Pre-compi...
|
closed |
low |
2025-12-17 02:57 |
- |
|
| #500 |
Performance: Regex not pre-compiled (semver)
api/blueprints/v1/apps.py:69-70 - Regex pattern compiled on every app version creation. FIX: Pre-com...
|
closed |
low |
2025-12-17 02:57 |
- |
|
| #499 |
Performance: Regex compiled inside hot path (steps)
api/blueprints/v1/steps.py:377 - re.compile() called on every log search request. FIX: Module-level ...
|
closed |
medium |
2025-12-17 02:57 |
- |
|
| #498 |
Memory: Days filter unbounded query DoS
api/blueprints/v1/workflows.py:814-885 - No upper bound on days param. User can request days=36500 l...
|
closed |
medium |
2025-12-17 02:57 |
- |
|
| #497 |
Memory: DataShard table unbounded loading
api/blueprints/v1/logs.py:90-119 - _read_table_to_pandas loads ENTIRE parquet tables. No pagination ...
|
closed |
medium |
2025-12-17 02:57 |
- |
|
| #496 |
Race: Workflow definition hash collision
api/blueprints/v1/workflows.py:236-256 - Concurrent submissions of same workflow can fail. FIX: Use ...
|
closed |
medium |
2025-12-17 02:57 |
- |
|
| #495 |
Race: App installation duplicate
api/blueprints/v1/tenant_apps.py:174-200 - TOCTOU in SELECT-then-INSERT. Concurrent installs cause 5...
|
closed |
medium |
2025-12-17 02:57 |
- |
|
| #494 |
Race: Signal duplicate send without idempotency
api/blueprints/v1/signals.py:33-64 - Concurrent POST /signals can create duplicate signals. FIX: Add...
|
closed |
medium |
2025-12-17 02:57 |
- |
|