Search results

security(info-disclosure): ArchivalController::getDestructionList returns 500 (SQL leak) for unknown id instead of 404

Status: Open.

#2146 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026

RegistersController::show() 500s with HTML error page on unknown id/uuid/slug instead of a clean 404

Status: Open.

#2144 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026

OpenRegister self-dogfooded /api/health and /api/metrics were 503ing (App controller is not enabled)

Status: Open.

#2143 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026

security(rbac): IDOR — findAcrossAllMagicTables ignores _rbac/_multitenancy on cross-schema UUID fallback

Status: Open.

#2137 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 26, 2026

CI: 'Features Check' gate runs scripts/extract-features.py, which does not exist in the repo

Status: Open.

#2101 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 25, 2026

saasMode:true — cross-org RBAC denial on internal schema reads (DocuDesk 'Document Template') despite adminOverride:true

Status: Open.

#2094 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 25, 2026

DbalObjectSourceProvider silently returns empty when the shared Source's organisation differs from the caller's active org (SaaS mode)

Status: Open.

#2089 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 24, 2026

schema.org markers are treated as cross-app inheritance — one app's schema can 500 the whole dashboard

Status: Open.

#2087 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 24, 2026

MultiTenancyTrait::applyActiveOrgFilter() calls orX() with zero args — fatal on NC34, breaks ALL dbal-source query-backed schemas

Status: Open.

#2084 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 24, 2026

Rewrite MCP provider discovery onto the same registration event as flow nodes

Status: Open.

#2077 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 24, 2026

Run persistence — the hidden critical path for five other workstreams

Status: Open.

#2076 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 24, 2026

Flow parity: MCP surface at parity with n8n's

Status: Open.

#2071 In ConductionNL/openregister;

· rubenvdlinde opened on Jul 24, 2026