Issues

• release: 0.6.0 was compiled by rustc 1.98.0, which has a critical vtable miscompile fixed in 1.98.1

  bug
  plusky/bugwarden#346 · Filter by author plusky opened on Sep 29, 2026

• hardening: three fail-open corners found in review

  bug
  plusky/bugwarden#341 · Filter by author plusky opened on Sep 27, 2026

• security: bug_info serves BMO's comment_count, which counts private comments

  security
  plusky/bugwarden#340 · Filter by author plusky opened on Sep 27, 2026

• server: refuse self-dependency and self-duplicate before Bugzilla

  enhancement
  plusky/bugwarden#339 · Filter by author plusky opened on Sep 27, 2026

• server: keep Bugzilla's error text out of read-tool results

  security
  plusky/bugwarden#338 · Filter by author plusky opened on Sep 27, 2026

• security: quicksearch field predicates probe links, comments and attachments the guard hides

  security
  plusky/bugwarden#337 · Filter by author plusky opened on Sep 27, 2026

• security: the database's collation can equate product names a policy glob tells apart

  security
  plusky/bugwarden#330 · Filter by author plusky opened on Sep 17, 2026

• audit: a malformed audit config is refused after the preflight and the OTLP probe

  audit
  plusky/bugwarden#329 · Filter by author plusky opened on Sep 17, 2026

• release: container provenance attests a digest no published tag references

  bugdockergithub_actions
  plusky/bugwarden#328 · Filter by author plusky opened on Sep 17, 2026

• audit: failing() takes the sink mutex on a tokio worker every routed call

  audit
  plusky/bugwarden#327 · Filter by author plusky opened on Sep 17, 2026

• audit: OTLP batches have no byte bound; one 413 loses up to 512 records

  audit
  plusky/bugwarden#326 · Filter by author plusky opened on Sep 17, 2026

• audit: outcome.class records upstream failures as refused, not error

  auditbug
  plusky/bugwarden#325 · Filter by author plusky opened on Sep 17, 2026

• security: Bug ID custom fields escape the I14 scrub and write-side assessment

  security
  plusky/bugwarden#324 · Filter by author plusky opened on Sep 17, 2026

• security: write tools forward Bugzilla's error text, which can name hidden bugs

  security
  plusky/bugwarden#323 · Filter by author plusky opened on Sep 17, 2026

• server: the initialize version-fallback line is WARN for a designed outcome; rmcp 3.3 demoted its twin to debug

  enhancement
  plusky/bugwarden#320 · Filter by author plusky opened on Sep 16, 2026

• audit: a stdio call still in flight when stdin closes or SIGTERM lands reaches Bugzilla with no record

  audit
  plusky/bugwarden#319 · Filter by author plusky opened on Sep 16, 2026

• ci: four action pins comment only the major version, against dependabot.yml's # vX.Y.Z rule

  github_actions
  plusky/bugwarden#318 · Filter by author plusky opened on Sep 16, 2026

• calls-per-task: no mtui#624-style polling here, measured — the one repeat pattern is a scheduled watch; make a poll cheap with changed_since on bugs_quicksearch

  ai-assistedenhancement
  plusky/bugwarden#315 · Filter by author plusky opened on Sep 14, 2026