2026-04-28 - 2026-07-28
Overview
5 Pull requests merged by 2 users
Merged
#95 security: batch of fixes
Merged
#94 fix(user-agent): zombie sessions #74
Merged
#83 security(server): bind grant revocation state (revoked_at) to integrity hash
Merged
#93 fix(smlang::statemachine): macro invocation requires inner types to be public
Merged
#92 housekeeping(server): deps upgrade + diesel migration to AsyncFnOnce
4 Pull requests proposed by 2 users
Proposed
#91 WIP: feat-shamir
Proposed
#98 deps(server): version bump
Proposed
#99 hashable-integrable-macro
Proposed
#100 fix: terminate VaultGate connection after vault lockout
15 Issues closed from 1 user
Closed
#79 Not using quantum-resistant schemes
Closed
#59 Bootstrap token persists on disk with weak file permissions
Closed
#60 Unseal and bootstrap handshake lack brute-force protection
Closed
#64 User-agent signing endpoint accepts arbitrary client_id
Closed
#73 Consumed bootstrap token is not zeroized in memory
Closed
#67 Bootstrap token RNG seeding should be made explicit
Closed
#65 Integrity envelopes do not survive root key rotation
Closed
#54 Encrypted key material not bound to wallet address — cross-wallet signing possible
Closed
#71 Wallet-access revocation deletes by wallet_id instead of entry id
Closed
#63 SDK client metadata is silently rewritten on reconnect
Closed
#52 Come up with mechanism for enforcing integrity protection usage
Closed
#68 RequestTracker allows arbitrary gaps across request flows
Closed
#74 Zombie user-agent sessions can block all new client approvals
Closed
#62 Bootstrap token registration lacks proof of possession
Closed
#56 revoked_at is not included in signature
2 Issues created by 1 user
Opened
#96 Allow clippy's CI to automatically fix some of the linting issues
Opened
#97 Require explicit VERSION in Integrable trait
4 Unresolved Conversations
Open
#66
Transaction logs can be tampered with to reset rate limits
Open
#70
Client approval quorum differs from documented consensus model
Open
#86
suspicious as keywords
Open
#37
Useragent doesn't check server certificate