Repository Issue Activity (beta)

#5364 Reject symbolic and hard links in untrusted TAR archives

#5452 Remove duplicate button is invisible to non-admins

#5440 cant disable setting to have long lived bots not fuzz jobs

#5321 Pushin

#5319 /issue/<testcase_id> redirector omits the testcase access check, disclosing the existence and restricted bug URL of security-sensitive testcases

#5436 system/archive.py: tar hard link linknames with '..' can overwrite files outside the extraction directory

#5428 Fuzzer metadata injection via decode_to_unicode errors='ignore' + splitlines() line separator abuse

#5301 mojo_parse_message_fuzzer: Stack-overflow in mojo::internal::ArraySerializationHelper<mojo::internal::Pointer<mojo::internal:

#5300 Yu

#5257 Security: Stored XSS in ClusterFuzz testcase event history via uploaded fuzzer name

#5015 Add support for filing GitHub Security Advisories via `file_github_security_advisory`

#5262 Cross-object authorization issue in /testcase-detail/update-issue allows testcase-scoped access to update unrelated issue IDs

#5258 Two handlers missing access checks: `issue_redirector` and `coverage_report`

#802 new_edge and new_features stat may be incorrect (e.g. -max_len is used or -use_value_profile)

#4517 [Tech debt] Split success and error return values in uworker_output.ErrorType

#5230 insecurity threats

#5228 Hacked

#5217 Large repro cases are missing tgz file extensions

#5168 Open Redirect on Clusterfuzz.com

#5208 Mrr

#5197 /gcs-redirect has no authentication — unauthenticated GCS object existence probing and open redirect

#5196 /testcase-detail/task-log has no authentication — unauthenticated log access with log filter injection

#5202 Feature request: MCP server for AI-assisted crash triage and fuzzer management

#4894 Instructions for using untrusted workers

#5075 Is there a way to configure clusterfuzz to only file security issues?