Search results

No circuit breaker for did:web resolution — one bad issuer poisons the service

mediumMedium severityMedium severity

Status: Open.

#22 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

No structured logging — operational visibility is blind

mediumMedium severityMedium severity

Status: Open.

#21 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

/verify endpoint has no nonce protection — bundles can be replayed indefinitely

highHigh severityHigh severity

securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

Status: Open.

#20 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

No rate limiting — Ed25519 verification is a free CPU burn

highHigh severityHigh severity

securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

Status: Open.

#19 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

Examples: DRS in real agentic systems

good first issueGood for newcomersGood for newcomers

Status: Open.

#18 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

Store put errors silently discarded after successful verification

mediumMedium severityMedium severity

securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

Status: Open.

#17 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

Admin token comparison is not constant-time

mediumMedium severityMedium severity

securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

Status: Open.

#16 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

Filesystem store vulnerable to path traversal via crafted hash

highHigh severityHigh severity

securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

Status: Open.

#15 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

Policy cost check bypassed by NaN, Infinity, and negative values

highHigh severityHigh severity

securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

Status: Open.

#14 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

Missing correlation_id and budget fields on receipts

mediumMedium severityMedium severity

securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

Status: Open.

#13 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

Ed25519 verification strictness differs between Rust and Go

mediumMedium severityMedium severity

securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

Status: Open.

#12 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026

No key management — developers will store raw private keys in plaintext

highHigh severityHigh severity

securitySecurity vulnerability or hardeningSecurity vulnerability or hardening

Status: Open.

#11 In OkeyAmy/DRS;

· OkeyAmy opened on Apr 14, 2026