Search results

Validate DPoP proofs in /oauth2/token/verify forward-auth endpoint

enhancementNew feature or requestNew feature or request

Status: Open.

#193 In highflame-ai/zeroid;

· rsharath opened on Jun 5, 2026

Introspection/revocation endpoints unauthenticated (RFC 7662 token-scanning)

securitySecurity issueSecurity issue

spec-complianceDeviation from SPIFFE/WIMSE/JWT-SVID specsDeviation from SPIFFE/WIMSE/JWT-SVID specs

Status: Open.

#192 In highflame-ai/zeroid;

· rsharath opened on Jun 5, 2026

Reflected token in OAuth validation error body (credential leak)

bugSomething isn't workingSomething isn't working

securitySecurity issueSecurity issue

Status: Open.

#191 In highflame-ai/zeroid;

· rsharath opened on Jun 5, 2026

Move OAuth endpoints (token/introspect/revoke) off Huma to plain chi

enhancementNew feature or requestNew feature or request

spec-complianceDeviation from SPIFFE/WIMSE/JWT-SVID specsDeviation from SPIFFE/WIMSE/JWT-SVID specs

Status: Open.

#190 In highflame-ai/zeroid;

· rsharath opened on Jun 5, 2026

OAuth access tokens: use RFC 9068 at+jwt typ header (config-overridable)

enhancementNew feature or requestNew feature or request

spec-complianceDeviation from SPIFFE/WIMSE/JWT-SVID specsDeviation from SPIFFE/WIMSE/JWT-SVID specs

Status: Open.

#189 In highflame-ai/zeroid;

· rsharath opened on Jun 5, 2026

fix: delegation graph shows incomplete tree when identity has multiple missions

bugSomething isn't workingSomething isn't working

Status: Open.

#181 In highflame-ai/zeroid;

· Goonjan opened on Jun 3, 2026

Support mission_id-indexed cascade for whole-mission revocation

Status: Open.

#173 In highflame-ai/zeroid;

· saucam opened on Jun 1, 2026

Jupyter Quickstart notebook out of date?

documentationImprovements or additions to documentationImprovements or additions to documentation

Status: Open.

Bug

#171 In highflame-ai/zeroid;

· dbfr3qs opened on May 29, 2026

fix: create-api-key 500s (uuid 22P02) when product and identity_id both omitted

bugSomething isn't workingSomething isn't working

Status: Open.

#149 In highflame-ai/zeroid;

· saucam opened on May 17, 2026

refactor: extract shared HTTP retry helper from dispatchPing + postCallback

Status: Open.

#140 In highflame-ai/zeroid;

· rsharath opened on May 13, 2026

security: rate-limit /oauth2/bc-authorize (per-client + per-user)

Status: Open.

#139 In highflame-ai/zeroid;

· rsharath opened on May 13, 2026

feat: support login_hint_token and id_token_hint on /oauth2/bc-authorize (CIBA Core §7.1)

Status: Open.

#137 In highflame-ai/zeroid;

· rsharath opened on May 13, 2026