Search results

seed-portwatch-port-activity: get to consistent 174/174 (currently 143 after DateOnly fix)

performancePerformance optimizationPerformance optimization

Status: Open.

#3613 In koala73/worldmonitor;

· koala73 opened on May 6, 2026

issues found

Status: Open.

#3567 In koala73/worldmonitor;

· FayezBast opened on May 2, 2026

[SUPPLY-CHAIN] Verify fast-xml-builder ^1.1.0 in blog-site is not typo-squatting fast-xml-parser

choreMaintenance, linting, toolingMaintenance, linting, tooling

securitySecurity-relatedSecurity-related

Status: Open.

#3553 In koala73/worldmonitor;

· koala73 opened on May 1, 2026

[SUPPLY-CHAIN] Pin Docker base images to digests + finish migrating GitHub Actions to SHA pins

choreMaintenance, linting, toolingMaintenance, linting, tooling

dockerDocker, self-hosting, containersDocker, self-hosting, containers

securitySecurity-relatedSecurity-related

Status: Open.

#3552 In koala73/worldmonitor;

· koala73 opened on May 1, 2026

[SUPPLY-CHAIN] @xenova/transformers ^2.17.2 deprecated — migrate to @huggingface/transformers

choreMaintenance, linting, toolingMaintenance, linting, tooling

securitySecurity-relatedSecurity-related

Status: Open.

#3551 In koala73/worldmonitor;

· koala73 opened on May 1, 2026

[SECURITY] Hardening: cap POST→GET array expansion + auto-add rel=noopener in safeHtml

area: APIBackend API, sidecar, keysBackend API, sidecar, keys

securitySecurity-relatedSecurity-related

Status: Open.

#3550 In koala73/worldmonitor;

· koala73 opened on May 1, 2026

[SECURITY] Tauri sidecar globalThis.fetch replacement has no SSRF guard — RSS proxy guard is not the global path

area: desktopTauri desktop appTauri desktop app

bugSomething isn't workingSomething isn't working

securitySecurity-relatedSecurity-related

Status: Open.

#3549 In koala73/worldmonitor;

· koala73 opened on May 1, 2026

[SECURITY] x-user-id header injection risk — gateway doesn't strip client-supplied x-user-id on legacy bearer path

area: APIBackend API, sidecar, keysBackend API, sidecar, keys

bugSomething isn't workingSomething isn't working

securitySecurity-relatedSecurity-related

Status: Open.

#3548 In koala73/worldmonitor;

· koala73 opened on May 1, 2026

[SECURITY] Add COEP / COOP headers — Spectre mitigation + SharedArrayBuffer for ML workers

performancePerformance optimizationPerformance optimization

securitySecurity-relatedSecurity-related

Status: Open.

#3547 In koala73/worldmonitor;

· koala73 opened on May 1, 2026

[SECURITY] Docker nginx CSP downgrades to 'unsafe-inline' vs Vercel's hash-based script-src

bugSomething isn't workingSomething isn't working

dockerDocker, self-hosting, containersDocker, self-hosting, containers

securitySecurity-relatedSecurity-related

Status: Open.

#3546 In koala73/worldmonitor;

· koala73 opened on May 1, 2026

[SECURITY] wm-pro-key / wm-widget-key stored JS-readable in localStorage + cookies — XSS = full key compromise

bugSomething isn't workingSomething isn't working

securitySecurity-relatedSecurity-related

Status: Open.

#3545 In koala73/worldmonitor;

· koala73 opened on May 1, 2026

[SECURITY] widget-sanitizer postMessage uses '*' targetOrigin instead of explicit origin

area: panelsPanel system, layout, drag-and-dropPanel system, layout, drag-and-drop

bugSomething isn't workingSomething isn't working

securitySecurity-relatedSecurity-related

Status: Open.

#3544 In koala73/worldmonitor;

· koala73 opened on May 1, 2026