| #979 |
tests.helpers.dummy_functions is on the default python allowlist for every tenant in production
EARS SPEC:
- The default python task allowlist shall contain no test-only modules.
- If a tenant wor...
|
in-progress |
high |
2026-10-20 00:46 |
- |
|
| #969 |
Secret history triage: gitleaks finds 45 (highway) + 8 (engine) historical findings; default rules missed the [secrets] mail password
EARS SPEC:
- The Highway CI secret scan shall fail on any credential added to tracked files or histo...
|
in-progress |
high |
2026-10-20 00:09 |
- |
|
| #963 |
POST /admin/api-keys ignores documented expires_in_days; key never expires
EARS: When POST /api/v1/admin/api-keys receives expires_in_days, the API shall set expires_at = now ...
|
closed |
high |
2026-10-17 00:53 |
- |
|
| #959 |
Reply-tag wire address should use a keyed HMAC, not a plain hash
EARS: The wire reply tag shall be HMAC(server secret, tenant_id, tag) so a third party who knows a t...
|
closed |
medium |
2026-10-17 00:50 |
- |
|
| #949 |
Postgres password is the literal 'postgres'; rotate and stop sharing the superuser across services
EARS: No service shall connect to PostgreSQL with a default or repo-visible password; the superuser ...
|
closed |
critical |
2026-10-16 01:55 |
- |
|
| #945 |
Tenant-published app source escapes restricted builtins: root + docker.sock in worker
EARS: When a workflow task runs a tenant-published app action, the engine shall execute the app sour...
|
open |
critical |
2026-10-16 01:22 |
- |
|
| #943 |
dsl-compiler must not reach postgres/api (own egress-only network)
EARS: The dsl-compiler service, which executes user Python at compile time, shall have no network ro...
|
closed |
high |
2026-10-16 00:23 |
- |
|
| #924 |
Remove Vault: platform secrets from /etc/highway/secrets, tenant secrets AES-GCM in Postgres
EARS SPEC:
- The engine shall resolve platform secrets from /etc/highway/secrets (0600) and tenant s...
|
in-progress |
high |
2026-10-15 23:07 |
- |
|
| #916 |
P0c: Move cancel-time container cleanup to worker; drop docker.sock from api
EARS SPEC:
- When a workflow is cancelled, a worker task shall remove its containers.
- The api cont...
|
in-progress |
high |
2026-10-15 23:07 |
- |
|
| #915 |
P0b: Shell sandbox on by default, fail closed, remove ${PWD} worker mount
EARS SPEC:
- The engine shall run tools.shell.run inside the sandbox by default ([sandbox] enabled=t...
|
closed |
critical |
2026-10-15 23:07 |
- |
|
| #914 |
P0a: DockerPolicy gate for all docker tools (privileged/devices/cap_add/bind/host ns/foreign networks; tenant label ownership)
EARS SPEC:
- If a docker tool call requests privileged, devices, cap_add, a host bind mount, pid/ipc...
|
closed |
critical |
2026-10-15 23:07 |
- |
|
| #911 |
Token endpoint leaks caught exception text into client 500 responses (str(e) in details, f-string in raise)
EARS SPEC:
- When a token endpoint fails, the API shall return a generic error code and message to t...
|
in-progress |
high |
2026-08-22 13:33 |
- |
|
| #851 |
Vault token VAULT_TOKEN_ADMIN is invalid - OIDC/SSO sign-in and circuit-breaker API are down in production
EARS SPEC:
- When the Highway API cannot authenticate to Vault, the /api/v1/health circuit_breaker_d...
|
open |
critical |
2026-08-22 01:50 |
- |
|
| #847 |
Encryption master key has an on-host env fallback next to the PostgreSQL data directory
EARS SPEC:
- The Highway platform shall source the JSONB encryption master key from Vault only; if V...
|
open |
high |
2026-08-03 20:47 |
- |
|
| #844 |
circuit-breakers 503: Vault password for resilient_circuit_db never applied to the postgres role
EARS SPEC:
- When GET /api/v1/circuit-breakers is called by an authorized caller, the Highway API sh...
|
closed |
critical |
2026-08-03 16:44 |
- |
|
| #842 |
Back-channel logout: accept identity logout_token, revoke Highway OIDC sessions
EARS SPEC:
- When identity POSTs a logout_token to /api/v1/auth/oidc/backchannel-logout, the API sha...
|
closed |
high |
2026-07-31 12:54 |
- |
|
| #840 |
Integrate RODMENA Identity (OIDC) as sign-in option for highway-dashboard
EARS SPEC:
- When a user chooses 'Sign in with RODMENA ID', the Highway API shall run an authorizati...
|
closed |
medium |
2026-07-31 10:55 |
- |
|
| #839 |
Upgrade auth to 3.0.0 (strict-default flip with grandfathering; client always raises)
EARS SPEC:
- The Highway platform shall pin auth>=3.0.0 and deploy it with the migrations entrypoint...
|
closed |
high |
2026-07-31 01:53 |
- |
|
| #838 |
Adopt key-backed users (auth rak_ API keys) per auth deprecation notice 2/2 (SPEC 0008)
EARS SPEC:
- When auth 3.0.0 strict identity becomes default, every Highway authorization subject (u...
|
closed |
high |
2026-07-31 00:50 |
- |
|
| #834 |
Upgrade auth lib to >=2.4.0 (auth 3.0.0 deprecation notice) + answer runflow RF-58 fix-notice
EARS SPEC:
- The Highway platform shall pin the auth Python library to >=2.4.0 (the 3.0.0 migration ...
|
closed |
high |
2026-07-30 23:26 |
- |
|