| #536 |
[API/Race] api/config.py module-level config fetch at import time
File: api/config.py:11. Module-level call to get_engine_config() executes Vault fetch at import time...
|
closed |
critical |
2025-12-17 16:28 |
- |
|
| #535 |
[API/Perf] version.py subprocess in async endpoint without caching
File: api/blueprints/v1/version.py:21-48. subprocess.run for git commands runs synchronously in asyn...
|
closed |
critical |
2025-12-17 16:28 |
- |
|
| #534 |
[API/Race] oauth2.py global config mutation not atomic
File: api/oauth_handlers/oauth2.py:37-39,95-106. Global _OAUTH2_CONFIG_CACHE dict assigned separatel...
|
closed |
critical |
2025-12-17 16:28 |
- |
|
| #533 |
[API/Memory] approvals.py connection leak in ApprovalService factory
File: api/blueprints/v1/approvals.py:28-33. get_approval_service() creates direct connection on ever...
|
closed |
critical |
2025-12-17 16:28 |
- |
|
| #532 |
[API/Bug] workflows.py:2074 - run_id undefined in retry_workflow
File: api/blueprints/v1/workflows.py:2074. Variable run_id is referenced but never defined. Function...
|
closed |
critical |
2025-12-17 16:28 |
- |
|
| #531 |
[API/Memory] signals.py connection leak - every signal operation leaks DB connection
File: api/blueprints/v1/signals.py:26-30. get_signal_service() creates DB connection with autocommit...
|
closed |
critical |
2025-12-17 16:28 |
- |
|
| #530 |
[API/Perf] Multiple database connections for single permission check
**File:** api/middleware/rbac.py:660-680
**Problem:** Permission check and role retrieval use separ...
|
closed |
low |
2025-12-17 15:00 |
- |
|
| #529 |
[API/Data] Validation lists should be frozensets
**Files:**
- api/middleware/validators.py:123 - valid_statuses list
- api/blueprints/v1/apps.py:158-...
|
closed |
low |
2025-12-17 15:00 |
- |
|
| #528 |
[API/Perf] Regex compilation in hot paths - multiple locations
**Files:**
- api/blueprints/v1/steps.py:377 - search regex compiled per-request
- api/blueprints/v1/...
|
closed |
medium |
2025-12-17 15:00 |
- |
|
| #527 |
[API/Perf] Sync subprocess blocks async event loop
**File:** api/blueprints/v1/workflows.py:115-122
**Problem:** `subprocess.run()` is synchronous and...
|
closed |
high |
2025-12-17 15:00 |
- |
|
| #526 |
[API/Perf] JWT config fetched from Vault on EVERY request
**File:** api/oauth_handlers/oauth2.py:115-133
**Problem:** `verify_jwt_token()` calls `get_oauth2_...
|
closed |
critical |
2025-12-17 15:00 |
- |
|
| #525 |
[API/Perf] N+1 query in queue analytics endpoint
**File:** api/blueprints/v1/analytics.py:63-68
**Problem:** For N queues, executes N+1 queries (1 f...
|
closed |
critical |
2025-12-17 15:00 |
- |
|
| #524 |
[API/Race] App installation duplicate on concurrent request
**File:** api/blueprints/v1/tenant_apps.py:174-200
**Problem:** Check for existing installation (SE...
|
closed |
medium |
2025-12-17 15:00 |
- |
|
| #523 |
[API/Race] Signal duplicate send - no idempotency
**File:** api/blueprints/v1/signals.py:33-64
**Problem:** Client retries can send duplicate signals...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #522 |
[API/Race] Rate limiter TOCTOU - incorrect quota enforcement
**File:** api/middleware/rate_limiter.py:22-47
**Problem:** `check_quota()` and `get_tenant_stats()...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #521 |
[API/Race] Workflow definition hash collision on concurrent submit
**File:** api/blueprints/v1/workflows.py:236-256
**Problem:** Two concurrent submissions of same wo...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #520 |
[API/Race] Approval double-processing - duplicate workflow signals
**File:** api/blueprints/v1/approvals.py:88-122
**Problem:** Two users clicking Approve simultaneou...
|
closed |
critical |
2025-12-17 14:59 |
- |
|
| #519 |
[API/Memory] Workflow graph generation - unbounded recursion
**File:** api/blueprints/v1/workflows.py:1283-1307, 1488-1526
**Problem:** Deeply nested workflows ...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #518 |
[API/Memory] Workflow list query - unbounded days filter
**File:** api/blueprints/v1/workflows.py:814-885
**Problem:** User can request `?days=36500` (100 y...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #517 |
[API/Memory] DataShard table unbounded memory loading
**File:** api/blueprints/v1/logs.py:90-119
**Problem:** `_read_table_to_pandas()` loads ENTIRE Data...
|
closed |
critical |
2025-12-17 14:59 |
- |
|