Issues

• Notion OAuth callback hardcoded to localhost — open redirect to attacker-controlled local server

  codextde/vectorbase-ai-knowledgebase#4 · Filter by author noobx123 opened on Jun 14, 2026

• Website crawler SSRF — Playwright fetches internal URLs with no IP allowlist

  codextde/vectorbase-ai-knowledgebase#3 · Filter by author noobx123 opened on Jun 14, 2026

• Caller-controlled model and max_tokens enables unlimited OpenAI cost abuse

  codextde/vectorbase-ai-knowledgebase#2 · Filter by author noobx123 opened on Jun 14, 2026

• Unauthenticated cron endpoints trigger cross-tenant source reprocessing

  codextde/vectorbase-ai-knowledgebase#1 · Filter by author noobx123 opened on Jun 14, 2026