All issues

Search results

Security Vulnerability

Status: Open.

#920 In workweave/router;

· jeminsec opened on Aug 16, 2026

force-model resolves provider from catalog Providers[0], ignoring excluded/unregistered providers; pin silently dropped next turn

Status: Open.

#874 In workweave/router;

· NathanLively opened on Aug 5, 2026

billing: 1-hour TTL cache writes are billed at the 5-minute 1.25x rate, undercharging by 37.5%

Status: Open.

#867 In workweave/router;

· mastermanas805 opened on Jul 31, 2026

ProxyOpenAIChatCompletion never runs the cross-envelope no-progress detector

Status: Open.

#825 In workweave/router;

· rohith500 opened on Jul 23, 2026

SQL queries for session_pins, DebitOrgCredits key_spend, and GetUserMonthlySpendAndLimit lack tenant-ownership predicates

Status: Open.

#796 In workweave/router;

· rohith500 opened on Jul 20, 2026

billing: org monthly spend-limit TOCTOU — concurrent preflights can overshoot a hard cap by N× request cost

Status: Open.

#793 In workweave/router;

· rohith500 opened on Jul 19, 2026

ProxyOpenAIChatCompletion never calls runCompactionHandover after PrefixTrimmed — OpenAI client-trim stays lose prior-work summary

Status: Open.

#791 In workweave/router;

· rohith500 opened on Jul 19, 2026

PreferredModels can poison the semantic cache — a hit serves another model's body while headers report the newly-scored model

Status: Open.

#789 In workweave/router;

· rohith500 opened on Jul 19, 2026

fix(cluster): Scorer.Route accepts non-finite and zero-norm embeddings

Status: Open.

#780 In workweave/router;

· rohith500 opened on Jul 17, 2026

fix(cluster): computeDialCalibration ignores AlphaFloor — QualityBias dial dead zone on floored bundles

Status: Open.

#779 In workweave/router;

· rohith500 opened on Jul 17, 2026

ProxyOpenAIChatCompletion never consumes UsageBypass: bypassToAnthropic + 429→routeFor fallthrough absent

Status: Open.

#775 In workweave/router;

· rohith500 opened on Jul 17, 2026

ProxyOpenAIChatCompletion has no post-dispatch failover: OSS-outage baseline retry and subscription-credit retry both absent

Status: Open.

#771 In workweave/router;

· rohith500 opened on Jul 17, 2026