Issues

[finding] `os validate` passes an `analyticsCubes` member the analytics door refuses: lint reads no cube, so a cube dimension over a JSON-stored field passes authoring and is refused 400 at query time

#21082

· objectstack-fleet opened

on Oct 1, 2026

security(plugin-audit): an activity row composed at write time may carry a changed field's values to a reader who can read the parent record but not that field (unmeasured; measure first)

finding

security

#21081

· objectstack-fleet opened

on Oct 1, 2026

security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there

finding

security

#21080

· objectstack-fleet opened

on Oct 1, 2026

security(plugin-security): a non-system caller who resolves no permission set is admitted to every object and read with no row scope; an empty set list grants by absence instead of answering the deny baseline

finding

security

#21079

· objectstack-fleet opened

on Oct 1, 2026

plugin-auth: if the first request arrives before the async OIDC discovery mount, it fails ("matcher is already built") and /.well-known/openid-configuration answers 404 for the process lifetime

#21078

· objectstack-fleet opened

on Oct 1, 2026

[finding] a date macro whose offset lands past the instants a JS Date holds (`{300000_years_ago}`, a huge `_minutes_ago`) resolves to the text "Invalid Date" (matches every row) or throws an uncoded RangeError (500)

#21068

· objectstack-fleet opened

on Oct 1, 2026

[finding] driver-sql's JSON-column refusal is about 800 characters and is cut at the REST envelope's 500, so no caller reads the sentence saying the field and operator were withheld

#21067

· objectstack-fleet opened

on Oct 1, 2026

[finding] driver-memory answers the equality and ordering family per element on a multi-valued field (`$eq` / `$in` / `$nin` / `$gt` on a `multiple: true` lookup), where driver-sql refuses all ten with 400 INVALID_FILTER

#21066

· objectstack-fleet opened

on Oct 1, 2026

security(spec): a capability-gated field (requiredPermissions, no maskingRule) is served stored to a caller who resolves no permission set, while explain reports it hidden; narrowing it moves getReadableFields' contract answer

#21063

· objectstack-fleet opened

on Oct 1, 2026

security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to

#21062

· objectstack-fleet opened

on Oct 1, 2026

security (P0 suspect): a non-system caller who resolves no permission set — an unauthenticated one included — is admitted to aggregate any object at an analytics door, object admission and row scope skipped

#21061

· objectstack-fleet opened

on Oct 1, 2026

QA P0 release sweep 2026-10-01 — checklist re-point for query-contract-matrix clause 6 + the run's checklist-accuracy findings and fixture gaps (anchor for #21056)

#21060

· objectstack-fleet opened

on Oct 1, 2026

Navigation Menu

All issues

[finding] `os validate` passes an `analyticsCubes` member the analytics door refuses: lint reads no cube, so a cube dimension over a JSON-stored field passes authoring and is refused 400 at query time

security(plugin-audit): an activity row composed at write time may carry a changed field's values to a reader who can read the parent record but not that field (unmeasured; measure first)

security(analytics): the native-SQL analytics path never runs engine read middlewares, so object-scoped read gates (comment threads, activity rows measured; attachments, approval payloads unmeasured) do not apply there

security(plugin-security): a non-system caller who resolves no permission set is admitted to every object and read with no row scope; an empty set list grants by absence instead of answering the deny baseline

plugin-auth: if the first request arrives before the async OIDC discovery mount, it fails ("matcher is already built") and /.well-known/openid-configuration answers 404 for the process lifetime

[finding] a date macro whose offset lands past the instants a JS Date holds (`{300000_years_ago}`, a huge `_minutes_ago`) resolves to the text "Invalid Date" (matches every row) or throws an uncoded RangeError (500)

[finding] driver-sql's JSON-column refusal is about 800 characters and is cut at the REST envelope's 500, so no caller reads the sentence saying the field and operator were withheld

[finding] driver-memory answers the equality and ordering family per element on a multi-valued field (`$eq` / `$in` / `$nin` / `$gt` on a `multiple: true` lookup), where driver-sql refuses all ten with 400 INVALID_FILTER

security(spec): a capability-gated field (requiredPermissions, no maskingRule) is served stored to a caller who resolves no permission set, while explain reports it hidden; narrowing it moves getReadableFields' contract answer

security(forms): two public-form doors meet a field masking rule wrongly — the submit read-back serves masked fields stored to an anonymous submitter, and a picker whose first display field is masked answers 403 to every caller it applies to

security (P0 suspect): a non-system caller who resolves no permission set — an unauthenticated one included — is admitted to aggregate any object at an analytics door, object admission and row scope skipped

QA P0 release sweep 2026-10-01 — checklist re-point for query-contract-matrix clause 6 + the run's checklist-accuracy findings and fixture gaps (anchor for #21056)

Search results