Search results

🔴 Webhooks exfiltrate unredacted directive args and output snippets

bugSomething isn't workingSomething isn't working

P1-high

security

Status: Open.

#167 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

·  

v1.0.6

🔴 MCP tool responses bypass final redaction (perseus_get_context, perseus_read, perseus_query)

bugSomething isn't workingSomething isn't working

P1-high

security

Status: Open.

#166 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

·  

v1.0.6

🔴 parallel_queries executes @query in false @if/@else branches — control-flow bypass

bugSomething isn't workingSomething isn't working

P1-high

security

Status: Open.

#165 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

·  

v1.0.6

Tests: add regression suite for v1.0.4 bugfix series

P3-low

tests

Status: Open.

#158 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

Enhancement: bump _workspace_hash to 16 hex chars for federation safety

enhancementNew feature or requestNew feature or request

mneme

P3-low

Status: Open.

#157 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

Refactor: serve.py is a 3000-line god-module — split into cli/*.py

P3-low

refactor

Status: Open.

#156 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

Enhancement: add XDG_CACHE_HOME to _safe_cache_dir allowlist (Linux)

enhancementNew feature or requestNew feature or request

P3-low

Status: Open.

#155 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

Refactor: directives/include.py mixed-type cycle-detection set is fragile

directives

P2-medium

refactor

Status: Open.

#154 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

Performance: parallel_services thread pool is unbounded (no parallel_max_workers cap)

P2-medium

performance

Status: Open.

#153 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

Performance: _memory_do_update reads every checkpoint file even on no-op

mneme

P2-medium

performance

Status: Open.

#152 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

Bug: serve binds to non-loopback without auth_token without prompting

bugSomething isn't workingSomething isn't working

P2-medium

security

Status: Open.

#151 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026

Bug: MCP SSE _check_auth allows empty Host header (loopback bypass)

bugSomething isn't workingSomething isn't working

P2-medium

security

Status: Open.

#150 In tcconnally/perseus;

· tcconnally opened on Jun 3, 2026