Issues

• relay: a refusal re-pin needs three edits and the third is held by nothing

  bugfactoryrewriterust
  cameri/nostream#1032 · Filter by author chappie-daemon opened on Nov 1, 2026 · Phase 2: Protocol core

• relay: the pin test's failure message calls the refusal bytes a wire contract they are not

  documentationfactoryrewriterust
  cameri/nostream#1028 · Filter by author chappie-daemon opened on Nov 1, 2026 · Phase 2: Protocol core

• relay: the module doc credits the encoder/decoder pair for a consistency only the pin test holds

  documentationfactoryrewriterust
  cameri/nostream#1027 · Filter by author chappie-daemon opened on Nov 1, 2026 · Phase 2: Protocol core

• Security: 9 low-severity findings across admin, adapters, payments and compose

  security
  cameri/nostream#1022 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: 7 low-severity findings in the CLI

  security
  cameri/nostream#1021 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: 6 low-severity findings in the message handlers and event strategies

  security
  cameri/nostream#1020 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: 16 low-severity findings in services, repositories and utils

  security
  cameri/nostream#1019 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: weak cryptography in src/cli/commands/setup.ts

  securityvulnerability
  cameri/nostream#1018 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: idor in src/services/payments-service.ts

  securityvulnerability
  cameri/nostream#1017 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: broken auth in src/admin/password-admin-auth-provider.ts

  securityvulnerability
  cameri/nostream#1016 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: sensitive data exposure in src/handlers/request-handlers/rate-limiter-middleware.ts

  securityvulnerability
  cameri/nostream#1015 · Filter by author chappie-daemon opened on Nov 1, 2026

• Security: authorization bypass in src/utils/settings.ts

  securityvulnerability
  cameri/nostream#1014 · Filter by author chappie-daemon opened on Nov 1, 2026

• relay: the settings validator must own the ceiling, not just the floor

  factoryrewriterust
  cameri/nostream#998 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  2

• relay: on a semantically rejected settings document, the bound report is silently dropped

  factoryrewriterust
  cameri/nostream#994 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  2

• relay: one address can exhaust the shared frame budget below its own socket cap

  factoryrewriterust
  cameri/nostream#992 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 1: Rust foundation

• relay: two sentences around the CLOSE-during-mint test claim more than it proves

  bugfactoryrewriterust
  cameri/nostream#984 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  1

• relay: the invite-mint-plus-CLOSE combination is covered by no test at the wire

  bugfactoryrewriterust
  cameri/nostream#983 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  1

• relay: a close-aborts-read test stays green under the delay it exists to catch

  bugfactoryrewriterust
  cameri/nostream#982 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core
  1

• test: the filter's created-at endpoint can be wrong by 100x and its parity suite still passes

  bugfactoryrewriterust
  cameri/nostream#981 · Filter by author chappie-daemon opened on Oct 25, 2026 · Phase 2: Protocol core

• Port the capture aborted-union detail: a wrong-typed field answers Invalid input, not the field message

  bugrewriterust
  cameri/nostream#979 · Filter by author chappie-daemon opened on Oct 25, 2026

• relay: a publish racing a kind-62 vanish request survives it

  bugfactoryrewriterust
  cameri/nostream#975 · Filter by author chappie-daemon opened on Oct 24, 2026 · Phase 2: Protocol core

• relay: extra frame elements are ignored where the capture rejects them

  bugfactoryrewriterust
  cameri/nostream#961 · Filter by author chappie-daemon opened on Oct 24, 2026 · Phase 2: Protocol core
  1

• relay: a float-spelled timestamp is rejected, which the capture accepts

  bugfactoryrewriterust
  cameri/nostream#960 · Filter by author chappie-daemon opened on Oct 24, 2026 · Phase 2: Protocol core
  1

• relay: inbound frames dispatch out of order, so a CLOSE can overtake its REQ

  bugfactoryrewriterust
  cameri/nostream#958 · Filter by author chappie-daemon opened on Oct 24, 2026 · Phase 2: Protocol core
  1

• test: census rows may overstate coverage

  bugfactoryrewriterust
  cameri/nostream#956 · Filter by author chappie-daemon opened on Oct 24, 2026 · Phase 2: Protocol core