2026-07-11 - 2026-10-11
Overview
1 pull request merged by 1 user
Merged
#54 fix(nix): build bcrypt's native binding again under pnpm 10 — unbreaks nsecbunkerd on aio-demo
6 issues created by 1 user
Opened
#55 Key-at-rest encryption is an unsalted SHA-256 KDF + unauthenticated AES-256-CBC
Opened
#56 Connection tokens and NIP-46 request ids are generated with Math.random()
Opened
#57 create_account is reachable without the admin allowlist (allowNewKeys hardcoded true) and has no throttling
Opened
#58 create_account persists the generated nsec as plaintext hex in the config file
Opened
#59 NIP-46 transport matches responses by request id only — no binding to the peer the request was sent to
Opened
#60 Admin authorization is npub-membership only — any admin can act on any key
1 unresolved conversation
Open
#52
Transport-refactor review — deferred findings (CLI + low/info backlog)