All issues

[repo-health] Low: observer.mjs crashes silently if OBSERVER_PORT env is non-numeric

#17

· Liohtml opened

on Jun 18, 2026

[repo-health] Medium: docker module has no unit tests — critical container logic is untested

#16

· Liohtml opened

on Jun 18, 2026

[repo-health] Low: No SECURITY.md — no vulnerability reporting policy or responsible disclosure channel

#15

· Liohtml opened

on Jun 17, 2026

[repo-health] Medium: Dockerfile fetches and executes remote shell scripts via curl | bash — supply-chain risk

#14

· Liohtml opened

on Jun 17, 2026

[repo-health] Low: Default port 4317 conflicts with IANA-assigned OpenTelemetry OTLP/gRPC port

#13

· Liohtml opened

on Jun 15, 2026

[repo-health] Medium: observer.mjs missing CORS headers — any browser tab can read agent session data

#12

· Liohtml opened

on Jun 14, 2026

[repo-health] Medium: ~/.claude dir bind-mounted read-write — container code can exfiltrate or corrupt host Claude credentials

#11

· Liohtml opened

on Jun 14, 2026

[repo-health] High: esbuild 0.28.0 — dev-server arbitrary file read (GHSA-67mh-4wv8-2f99)

#10

· Liohtml opened

on Jun 14, 2026

[repo-health] Low: Unpinned @anthropic-ai/claude-code in Dockerfile — image rebuilds may silently break

#9

· Liohtml opened

on Jun 13, 2026

[repo-health] Medium: --memory and --cpus flags have no validation — invalid values silently pass to docker run

#8

· Liohtml opened

on Jun 12, 2026

[repo-health] Low: Dead tail() function in observer.mjs — unused code and unnecessary readFileSync import

#7

· Liohtml opened

on Jun 12, 2026

[repo-health] Medium: Entry script written to predictable /tmp path — TOCTOU race on multi-user hosts

#6

· Liohtml opened

on Jun 12, 2026