Issues

docs: README states no requirements — git is an undocumented hard dependency

#496

· andytwoods opened

on Aug 24, 2026

abcd site build writes are os.Root-contained; reads still follow a committed directory symlink

#487

· jogrun opened

on Aug 24, 2026

version-location.json manifest_path is not contained, so payload stamp can write outside dest

#488

· jogrun opened

on Aug 24, 2026

abcd intent writes free text with no redaction, so a home path is committed

#486

· jogrun opened

on Aug 24, 2026

abcd capture kebab-cases the home path before redaction, so the username still lands in the filename

#485

· jogrun opened

on Aug 24, 2026

[iss-287] Uppercase YAML null spellings unrecognised by the null predicates

#374

· REPPL opened

on Aug 19, 2026

[iss-286] Release derivation diagnoses a null impact as malformed while record-lint calls it missing

#373

· REPPL opened

on Aug 19, 2026

[iss-285] Quoted YAML nulls split capture and record-lint verdicts

#372

· REPPL opened

on Aug 19, 2026

Percent-encoded delimiters defeat the leading `\b` on every secret token pattern, so a live PAT/JWT/AWS-key embedded in a URL-encoded URL (`%3Dghp_…`) survives `history.Capture` redaction and is written raw into the committed transcript

bug

needs-fix

severity:critical

#370

· REPPL opened

on Aug 19, 2026

All-dimensions bug-hunt loop state

#368

· REPPL opened

on Aug 19, 2026

`abcd memory lint` reads `.abcd/memory/config.json` (quotation budget) with raw `os.ReadFile` — no `O_NOFOLLOW`, no regular-file check, no size cap — so a committed symlinked `config.json` is followed: a FIFO/`/dev/zero` target hangs or OOMs the CLI (unswept metadata sibling of #336/#363)

bug

needs-fix

severity:major

#365

· REPPL opened

on Aug 19, 2026

`abcd memory` (bare status) and `abcd memory lint` crawl store pages with raw `os.ReadFile` — no regular-file check, no `O_NOFOLLOW`, no size cap — so a committed `.abcd/memory/*.md` symlink is followed: a FIFO/`/dev/zero` target hangs or OOMs the CLI and an out-of-store target is read into the quotation-coverage arithmetic (unswept sibling of #336)

bug

needs-fix

severity:major

#363

· REPPL opened

on Aug 19, 2026

Navigation Menu

Uh oh!

All issues

docs: README states no requirements — git is an undocumented hard dependency

abcd site build writes are os.Root-contained; reads still follow a committed directory symlink

version-location.json manifest_path is not contained, so payload stamp can write outside dest

abcd intent writes free text with no redaction, so a home path is committed

abcd capture kebab-cases the home path before redaction, so the username still lands in the filename

[iss-287] Uppercase YAML null spellings unrecognised by the null predicates

[iss-286] Release derivation diagnoses a null impact as malformed while record-lint calls it missing

[iss-285] Quoted YAML nulls split capture and record-lint verdicts

Percent-encoded delimiters defeat the leading `\b` on every secret token pattern, so a live PAT/JWT/AWS-key embedded in a URL-encoded URL (`%3Dghp_…`) survives `history.Capture` redaction and is written raw into the committed transcript

All-dimensions bug-hunt loop state

`abcd memory lint` reads `.abcd/memory/config.json` (quotation budget) with raw `os.ReadFile` — no `O_NOFOLLOW`, no regular-file check, no size cap — so a committed symlinked `config.json` is followed: a FIFO/`/dev/zero` target hangs or OOMs the CLI (unswept metadata sibling of #336/#363)

Uh oh!

Search results