Search results

security(spp_programs): Program Validator still carries Tier-2 registry viewer (Registry Search menu) [Severity: Low]

Status: Open.

#355 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_scoring): scoring viewers read all scoring results incl. registrant name + snapshot PII [Severity: Medium]

Status: Open.

#354 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_cel_domain): replace DCI sensitive-metric predicate denylist with an AST-level allowlist [Severity: Medium]

Status: Open.

#350 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_dci_indicators): precompute/fetch_values route bypasses DCI-sync access gate [Severity: Medium]

Status: Open.

#349 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_cel_domain): blanket base.group_user revoke on spp.data.value breaks DRIMS KPI computes [Severity: High if DRIMS-only roles exist]

Status: Open.

#348 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_cr_type_assign_program): program_id not frozen post-submit — applied program can differ from the approved one [Severity: Medium]

Status: Open.

#347 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_change_request_v2): free diff-padding evades duplicate detection once #264 and #343 both land [Severity: Low-Medium]

Status: Open.

#346 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(demo): default-credential users unguarded in spp_mis_demo_v2/spp_grm_demo/spp_drims_sl(_demo); + data->demo restructure [Severity: Medium]

Status: Open.

#345 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_change_request_v2): writable selected_field_name can steer dynamic-approval routing [Severity: Medium]

Status: Open.

#344 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 24, 2026

security(spp_registry_search): un-sudo'd sub-searches 500 for roles without ACL on phone/ID co-models [Severity: Low]

Status: Open.

#340 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 23, 2026

security(spp_registry_search): corrupt search config parameter makes every search 500 [Severity: Low]

Status: Open.

#339 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 23, 2026

security(spp_programs): async mark_*_as_done/_failed callbacks can clear operation locks via RPC (force-unlock bypass) [Severity: Low-Medium]

bugSomething isn't workingSomething isn't working

Status: Open.

#337 In OpenSPP/OpenSPP2;

· gonzalesedwin1123 opened on Jul 23, 2026