-
Notifications
You must be signed in to change notification settings - Fork 40
All issues
Issue creation is restricted in this repository
- #156 · nooga opened
on Jul 23, 2026
Issues
is:issue state:open
is:issue state:open
Search results
[Bug bounty] After a cluster enter→exit→delete lifecycle every NEW deploy is silently broken: host-port bindings black-holed from all sources and MANIFEST secrets never injected — deploy reports success, containers healthy at direct container IP, monkd restart does not recover
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyneeds-triage-humanDedup or scope verdict needs a human callDedup or scope verdict needs a human callver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#346 In monk-io/monk-plugin;[Bug bounty] monk.cluster.delete ignores the requested cluster name and destroys the currently SELECTED cluster —
cluster.delete {clusterName:"no-such-cluster-xyz"}deleted my live cluster bounty-test3bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#345 In monk-io/monk-plugin;[Bug bounty] monk.secret.add crashes with an unhandled "Maximum call stack size exceeded" (-32000) for values larger than ~120 KB — no schema hint, nothing logged, secret silently not stored
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#344 In monk-io/monk-plugin;[Bug bounty] cluster.peer.remove of a NONEXISTENT peer on a 1-node cluster reports that the fake id "is the only node and cannot be removed" — 2-node control is honest "no suitable peer"
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#343 In monk-io/monk-plugin;[Bug bounty] cicd.setup "validates" a repository the caller cannot write to (monk-io/monk-plugin) and asks the user to approve minting a 90-day cluster token before checking registry or repo write access
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#342 In monk-io/monk-plugin;[Bug bounty] monk cluster join --local-name is a silent no-op — joining node stays Name/Tag "local", so registry/watcher/CI/CD stay blocked on manual clusters
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyneeds-triage-humanDedup or scope verdict needs a human callDedup or scope verdict needs a human callver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#341 In monk-io/monk-plugin;[Bug bounty] cluster.ingress.ensure restarts dead remote Traefik (80→301) but cluster.ingress.status still errors "ingress plugin is not enabled" — recovered ingress is invisible
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#340 In monk-io/monk-plugin;[Bug bounty] secret.push of a name that does not exist returns ok:true with pushed:[] AND failed:[] — missing names are not reported as failures
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#339 In monk-io/monk-plugin;[Bug bounty] cluster.upgrade accepts an invalid version ("not-a-version"), opens a real upgrade approval, and starts "Upgrading the local node" before failing — version is not pre-validated
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#338 In monk-io/monk-plugin;[Bug bounty] monk.secret.add accepts an EMPTY name and slash-containing names ("a/b/c") and stores them — list shows name:"" ; remove of "" works but the empty key is a landmine
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#336 In monk-io/monk-plugin;[Bug bounty] org.usage reports a live, connected cluster as status:"stopped" — cluster.status connected:true and both peers active at the same moment
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyneeds-triage-humanDedup or scope verdict needs a human callDedup or scope verdict needs a human callver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#335 In monk-io/monk-plugin;[Bug bounty] workload.stop of monk/system/traefik (docs: never target system/*) reports success, stops Traefik on the REMOTE cluster peer, and leaves the LOCAL Traefik running
bug-bountyFiled during the July 2026 Monk plugin bug bountyFiled during the July 2026 Monk plugin bug bountyver:v0.1.58Filed against plugin v0.1.58Filed against plugin v0.1.58Status: Open.#334 In monk-io/monk-plugin;