| #538 |
[API/Perf] steps.py full data scan for count-only operation
Fixed: Added row_count() to DataShard, steps.py uses parquet metadata for count-only queries
|
closed |
high |
2025-12-17 16:29 |
- |
|
| #537 |
[API/Perf] signals.py:73 sync function blocks event loop
File: api/blueprints/v1/signals.py:73-94. get_signals is a synchronous function (def get_signals) de...
|
closed |
high |
2025-12-17 16:29 |
- |
|
| #527 |
[API/Perf] Sync subprocess blocks async event loop
**File:** api/blueprints/v1/workflows.py:115-122
**Problem:** `subprocess.run()` is synchronous and...
|
closed |
high |
2025-12-17 15:00 |
- |
|
| #523 |
[API/Race] Signal duplicate send - no idempotency
**File:** api/blueprints/v1/signals.py:33-64
**Problem:** Client retries can send duplicate signals...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #522 |
[API/Race] Rate limiter TOCTOU - incorrect quota enforcement
**File:** api/middleware/rate_limiter.py:22-47
**Problem:** `check_quota()` and `get_tenant_stats()...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #521 |
[API/Race] Workflow definition hash collision on concurrent submit
**File:** api/blueprints/v1/workflows.py:236-256
**Problem:** Two concurrent submissions of same wo...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #519 |
[API/Memory] Workflow graph generation - unbounded recursion
**File:** api/blueprints/v1/workflows.py:1283-1307, 1488-1526
**Problem:** Deeply nested workflows ...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #518 |
[API/Memory] Workflow list query - unbounded days filter
**File:** api/blueprints/v1/workflows.py:814-885
**Problem:** User can request `?days=36500` (100 y...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #514 |
[ENGINE/Perf] Regex compiled on every call in activity_context.py hot path
**File:** engine/activity_context.py:151-160
**Problem:** Pattern `r"\{\{([^}]+)\}\}"` is compiled ...
|
closed |
high |
2025-12-17 14:59 |
- |
|
| #512 |
[ENGINE/Race] Tenant config cache snapshot TOCTOU race
**File:** engine/config.py:640-661
**Problem:** TOCTOU between cache snapshot and cleanup - another...
|
closed |
high |
2025-12-17 14:58 |
- |
|
| #511 |
[ENGINE/Race] Circuit breaker storage singleton missing lock
**File:** engine/config.py:337-365
**Problem:** Missing lock for singleton initialization. Two thre...
|
closed |
high |
2025-12-17 14:58 |
- |
|
| #510 |
[ENGINE/Memory] Vault secret cache entries never proactively removed
**File:** engine/config.py:82-83
**Problem:** Cache entries are checked for expiration on read but ...
|
closed |
high |
2025-12-17 14:58 |
- |
|
| #509 |
[ENGINE/Memory] Unbounded tenant config cache cleanup
**File:** engine/config.py:593-610
**Problem:** The tenant config cache can grow unbounded if tenan...
|
closed |
high |
2025-12-17 14:58 |
- |
|
| #493 |
Race: Approval double-processing
api/blueprints/v1/approvals.py:88-122 - Concurrent approve requests can both succeed, sending duplic...
|
closed |
high |
2025-12-17 02:57 |
- |
|
| #492 |
Performance: Synchronous subprocess blocks event loop
api/blueprints/v1/workflows.py:115-122 - subprocess.run() blocks async handler for up to 10s. Stalls...
|
closed |
high |
2025-12-17 02:57 |
- |
|
| #491 |
Performance: N+1 query in queue analytics
api/blueprints/v1/analytics.py:63-68 - Database query inside loop for each queue. 50 queues = 51 que...
|
closed |
high |
2025-12-17 02:57 |
- |
|
| #490 |
Performance: JWT config fetched from Vault on EVERY request
api/oauth_handlers/oauth2.py:128 - get_oauth2_config() fetches 4 secrets from Vault on every authent...
|
closed |
high |
2025-12-17 02:57 |
- |
|
| #481 |
Performance: Regex not pre-compiled in activity_context.py
engine/activity_context.py:151-160 - resolve_variable_references() compiles regex on every call. Hot...
|
closed |
high |
2025-12-17 02:25 |
- |
|
| #480 |
Race Condition: Circuit breaker storage singleton without lock
engine/config.py:337-365 - _get_circuit_breaker_storage() creates singleton without thread-safe lock...
|
closed |
high |
2025-12-17 02:25 |
- |
|
| #474 |
Performance: Regex compiled on every call in variable_resolver.py
engine/interpreters/variable_resolver.py lines 196, 207, 240
Hot path compiles regex patterns on ev...
|
closed |
high |
2025-12-17 01:42 |
- |
|