Issues

• Security: Default bind address 0.0.0.0 exposes service on all interfaces

  security
  mantono/flagpole#104 · Filter by author mantono opened on Apr 8, 2026

• Security: No rate limiting on API endpoints

  security
  mantono/flagpole#103 · Filter by author mantono opened on Apr 8, 2026

• Security: Weak constant-time comparison guarantee in auth

  security
  mantono/flagpole#102 · Filter by author mantono opened on Apr 8, 2026

• Security: API key visible in process listing via CLI argument

  security
  mantono/flagpole#101 · Filter by author mantono opened on Apr 8, 2026

• Security: Redis crate compiled unconditionally, increasing attack surface

  security
  mantono/flagpole#100 · Filter by author mantono opened on Apr 8, 2026

• Security: Unbounded resource consumption via large inputs

  security
  mantono/flagpole#99 · Filter by author mantono opened on Apr 8, 2026

• Security: Denial of service via RwLock poisoning

  security
  mantono/flagpole#98 · Filter by author mantono opened on Apr 8, 2026

• Security: Log injection via JSON logging formatter

  security
  mantono/flagpole#97 · Filter by author mantono opened on Apr 8, 2026

• Security: Log injection via JSON logging formatter

  security
  mantono/flagpole#96 · Filter by author mantono opened on Apr 8, 2026

• Add support for Cloudflare KV

  enhancement
  mantono/flagpole#51 · Filter by author mantono opened on Aug 17, 2024