2026-10-04 - 2026-10-11
Overview
There has not been any commit activity in this period.
6 issues created by 1 user
Opened
#55 Key-at-rest encryption is an unsalted SHA-256 KDF + unauthenticated AES-256-CBC
Opened
#56 Connection tokens and NIP-46 request ids are generated with Math.random()
Opened
#57 create_account is reachable without the admin allowlist (allowNewKeys hardcoded true) and has no throttling
Opened
#58 create_account persists the generated nsec as plaintext hex in the config file
Opened
#59 NIP-46 transport matches responses by request id only — no binding to the peer the request was sent to
Opened
#60 Admin authorization is npub-membership only — any admin can act on any key
1 unresolved conversation
Open
#52
Transport-refactor review — deferred findings (CLI + low/info backlog)