All issues

Search results

Coordinated disclosure: github-safe.js helper interpolates argv into a shell string passed to execSync (AS-S001)

Status: Open.

#3411 In ruvnet/ruflo;

· xuange-hu opened on Sep 24, 2026

Security research: reproduce A2M metadata attraction and adversarial MCP output steering

Status: Open.

#3408 In ruvnet/ruflo;

· ruvnet opened on Sep 23, 2026

[Dream Cycle 2026-09-22] intelligence: EWCConsolidator.updateFisherFromConfidences() inverts its own EMA direction, defeating EWC++'s anti-forgetting purpose + capabilities,memory scan

capabilities

dream-cycle

intelligence

memory

research

Status: Open.

#3394 In ruvnet/ruflo;

· ruvnet opened on Sep 22, 2026

npx @claude-flow/cli@latest doesn't reliably re-resolve @claude-flow/memory to a newer semver-eligible version — silently defeats multi-package fixes

Status: Open.

#3392 In ruvnet/ruflo;

· anorlandrtc opened on Sep 22, 2026

SOTA: task-conditioned resource admission and allocation for agent tools

Status: Open.

#3388 In ruvnet/ruflo;

· ruvnet opened on Sep 21, 2026

[Dream Cycle 2026-09-21] security: validateEnv() denylist missing PATH/search-path family (CWE-427) + intelligence,swarm scan

dream-cycle

intelligence

research

security

swarm

Status: Open.

#3384 In ruvnet/ruflo;

· ruvnet opened on Sep 21, 2026

Experiment: route single versus multi agent execution by dependency structure

Status: Open.

#3381 In ruvnet/ruflo;

· ruvnet opened on Sep 20, 2026

Security: harden background Git invocations against repository local execution hooks

Status: Open.

#3380 In ruvnet/ruflo;

· ruvnet opened on Sep 20, 2026

[Dream Cycle 2026-09-20] performance: UnifiedSwarmCoordinator busy-poll → event-driven task wait + security,hive-mind scan

dream-cycle

hive-mind

performance

research

security

Status: Open.

#3377 In ruvnet/ruflo;

· ruvnet opened on Sep 20, 2026

embeddings init reports success after skipping the model download, and writes a config asserting a model that isn't there

Status: Open.

#3376 In ruvnet/ruflo;

· HF-teamdev opened on Sep 20, 2026

init: Grok Build CLI is invisible to ruflo although Grok already reads most of what ruflo init writes (no host row, no auto-detect, and the one Grok-specific step is undocumented)

Status: Open.

#3372 In ruvnet/ruflo;

· HF-teamdev opened on Sep 19, 2026

tests: running the CLI test suite edits the developer's ~/.claude/CLAUDE.md and ~/.codex/config.toml (init-kebab-flags-2952 inherits the real HOME)

Status: Open.

#3370 In ruvnet/ruflo;

· HF-teamdev opened on Sep 19, 2026