Issues

• F-030: is_crd heuristic misses CRDs and misidentifies non-CRDs

  adversary-findingseverity-low
  witlox/taba#22 · Filter by author witlox opened on Sep 15, 2026

• F-029: Potential YAML billion laughs via generic Value deserialization

  adversary-findingseverity-medium
  witlox/taba#21 · Filter by author witlox opened on Sep 15, 2026

• F-027: push command cache filename + permissions

  adversary-findingseverity-low
  witlox/taba#20 · Filter by author witlox opened on Sep 15, 2026

• F-025: Duplicate shards silently overwrite without detection

  adversary-findingseverity-low
  witlox/taba#19 · Filter by author witlox opened on Sep 15, 2026

• F-024: No integrity verification of reconstructed erasure data

  adversary-findingseverity-medium
  witlox/taba#18 · Filter by author witlox opened on Sep 15, 2026

• F-023: Incarnation number not bounded — u64::MAX locks out legitimate updates

  adversary-findingseverity-medium
  witlox/taba#17 · Filter by author witlox opened on Sep 15, 2026

• F-022: No rate limiting on join/leave — Sybil attack

  adversary-findingseverity-medium
  witlox/taba#16 · Filter by author witlox opened on Sep 15, 2026

• F-021: Key confusion in handle_message for MembershipChange

  adversary-findingseverity-medium
  witlox/taba#15 · Filter by author witlox opened on Sep 15, 2026

• F-019: No independent cycle check at graph insertion

  adversary-findingseverity-medium
  witlox/taba#14 · Filter by author witlox opened on Sep 15, 2026

• F-015: replay error classification uses fragile string matching

  adversary-findingseverity-low
  witlox/taba#13 · Filter by author witlox opened on Sep 15, 2026

• F-014: Compaction ignores remove_file errors

  adversary-findingseverity-medium
  witlox/taba#12 · Filter by author witlox opened on Sep 15, 2026

• F-013: WalPosition is per-segment offset, not global — ambiguous across segments

  adversary-findingseverity-medium
  witlox/taba#11 · Filter by author witlox opened on Sep 15, 2026

• F-010: provenance_payload silently returns empty on serialization failure

  adversary-findingseverity-low
  witlox/taba#10 · Filter by author witlox opened on Sep 15, 2026

• F-009: SLSA level is self-attested, not cryptographically verified

  adversary-findingseverity-medium
  witlox/taba#9 · Filter by author witlox opened on Sep 15, 2026

• F-007: verify_software_attestation does not verify node_id

  adversary-findingseverity-low
  witlox/taba#8 · Filter by author witlox opened on Sep 15, 2026

• F-006: Software attestation forgeable — no runtime gate against production use

  adversary-findingseverity-medium
  witlox/taba#7 · Filter by author witlox opened on Sep 15, 2026

• F-005: Duplicate assignment in build_exp_table

  adversary-findingseverity-info
  witlox/taba#6 · Filter by author witlox opened on Sep 15, 2026

• F-004: Intermediate share values not zeroized after reconstruction

  adversary-findingseverity-low
  witlox/taba#5 · Filter by author witlox opened on Sep 15, 2026

• F-003: reconstruct_secret does not validate the threshold

  adversary-findingseverity-medium
  witlox/taba#4 · Filter by author witlox opened on Sep 15, 2026

• F-002: gf_pow produces wrong results — dead code but latent

  adversary-findingseverity-low
  witlox/taba#3 · Filter by author witlox opened on Sep 15, 2026

• F-001: gf_div uses production assert! — panics on zero denominator

  adversary-findingseverity-medium
  witlox/taba#2 · Filter by author witlox opened on Sep 15, 2026