Repository Issue Activity (beta)

#1486 Security Audit

#1484 [Bug Report] commands.run forwards a non-positive timeoutMs to envd, hanging every command (Node & Python)

#1482 [Bug Report] CubeAPI rejects the official E2B SDK's `network.rules` map shape, breaking drop-in SDK compatibility

#1209 [Bug Report] Direct mode unconditionally sets destination MAC to gateway MAC

#1047 [Feature Request] zero-latency optimization for cross-sidecar wakeup via Redis Pub/Sub

#1410 [Bug Report] Injected credentials can be exfiltrated to any destination IP on the plaintext HTTP path

#1428 [Bug Report] policy_store silently evicts live policies, and policy.count() over-reports

#1474 [Bug Report] gRPC connection-pool refcount clamps are dead code; an unbalanced release permanently disables idle trimming

#1468 [Bug Report] Node SDK accepts transform.headers as an array, injecting credentials under header names "0" and "1"

#1466 [Bug Report] SDK render() previews disagree with the data plane when the inject format repeats ${SECRET}

#1464 [Bug Report] Broken ceiling division silently rounds CubeMaster's create/destroy concurrency limits down

#1462 [Bug Report] Shadowed err makes CubeMaster accept malformed cpu/mem as 0/0, bypassing scheduler resource filters

#1460 [Bug Report] The race detector is not enabled in any test target, so concurrency bugs ship undetected

#1458 [Bug Report] CubeEgress accepts wrong-typed match.method / match.scheme, then returns nginx 500 for every request from that sandbox

#1456 [Bug Report] Scheduler score-plugin errors are silently swallowed

#1454 [Bug Report] MITM leaf certificate serials use an unseeded PRNG and are silently omitted on failure

#1452 [Bug Report] cubelog.Fatalf does not exit, despite the name, and is used inside recover handlers

#1448 [Bug Report] Duplicate get_host definitions in the sdk_compat adapters silently discard the working implementation

#1440 [Bug Report] PortBinder.Reserve rollback revokes host ports belonging to an earlier successful reservation

#1438 [Bug Report] CubeAPI rejects a spec-compliant lowercase `bearer` auth scheme

#1436 [Bug Report] Scheduler filter intersection counts occurrences instead of membership, so a duplicate can defeat another filter

#1430 [Bug Report] multilock's GC evicts locks that are still in use, so mutual exclusion can be lost

#1418 [Bug Report] crypto.VerifyPassword(\"\", \"\") returns true

#1416 [Bug Report] Go and Node SDKs skip the allow_out deny-all guard for non-ASCII domains

#1412 [Bug Report] CubeProxy admin API fails open when no token is configured, and the entrypoint binds it to 0.0.0.0