Search results

[BUG] Notification Webhook Delivery Bypasses Network Policy Egress Controls — Complete Audit Gap

priority:mediumImportant issue with normal urgencyImportant issue with normal urgency

type:bugBug fix work category bonus labelBug fix work category bonus label

Status: Open.

#755 In utksh1/SecuScan;

· ionfwsrijan opened on Jun 10, 2026

[BUG] Network Policy Default Configuration Blocks All External Scanning — Tool Unusable Out of the Box

priority:mediumImportant issue with normal urgencyImportant issue with normal urgency

type:bugBug fix work category bonus labelBug fix work category bonus label

Status: Open.

#753 In utksh1/SecuScan;

· ionfwsrijan opened on Jun 10, 2026

[BUG] SSRF via Unvalidated Notification Webhook Destinations — Cloud Metadata Exfiltration & Internal Service Probing

priority:mediumImportant issue with normal urgencyImportant issue with normal urgency

type:bugBug fix work category bonus labelBug fix work category bonus label

Status: Open.

#752 In utksh1/SecuScan;

· ionfwsrijan opened on Jun 10, 2026

[Bug]: Workflow management endpoints lack owner_id scoping — any user can list/modify/delete all workflows

Status: Open.

#743 In utksh1/SecuScan;

· Pcmhacker-piro opened on Jun 10, 2026

[Bug]: Workflow scheduler creates tasks with DEFAULT_OWNER_ID instead of preserving workflow creator's identity

Status: Open.

#742 In utksh1/SecuScan;

· Pcmhacker-piro opened on Jun 10, 2026

[Bug]: Inconsistent filesystem target detection in executor bypasses safe-mode target validation

Status: Open.

#741 In utksh1/SecuScan;

· Pcmhacker-piro opened on Jun 10, 2026

[Bug]: Notification rule endpoints lack owner_id scoping — any user can view/modify/delete others' notification rules

Status: Open.

#740 In utksh1/SecuScan;

· Pcmhacker-piro opened on Jun 10, 2026

[Bug]: Vault secrets CRUD endpoints lack owner_id scoping — any user can read/decrypt/modify/delete all secrets

Status: Open.

#739 In utksh1/SecuScan;

· Pcmhacker-piro opened on Jun 10, 2026

[HIGH] IPv6 address parsing in validate_command_network_egress bypasses network policy

Status: Open.

#725 In utksh1/SecuScan;

· Pcmhacker-piro opened on Jun 9, 2026

[MEDIUM] cancel_task race condition — KeyError and DB status corruption on concurrent task completion

Status: Open.

#724 In utksh1/SecuScan;

· Pcmhacker-piro opened on Jun 9, 2026

[MEDIUM] Parser sandbox thread safety — proc.kill() races with proc.wait() causing undefined behavior

Status: Open.

#723 In utksh1/SecuScan;

· Pcmhacker-piro opened on Jun 9, 2026

[HIGH] require_api_key has blanket bypass for all admin routes — defense-in-depth failure

Status: Open.

#722 In utksh1/SecuScan;

· Pcmhacker-piro opened on Jun 9, 2026