All issues

Search results

Security: formula DSL inherits API tokens and unrelated parent credentials

Status: Open.

#856 In indaco/malt;

· rustytrees opened on Aug 13, 2026

Security: native DSL mutation variants can write or delete outside the prefix

Status: Open.

#855 In indaco/malt;

· rustytrees opened on Aug 13, 2026

Security: TAR pre-scan misses GNU long-name and long-link metadata

Status: Open.

#854 In indaco/malt;

· rustytrees opened on Aug 13, 2026

Security: predictable ZIP cask extraction paths can redirect writes outside the prefix

Status: Open.

#853 In indaco/malt;

· rustytrees opened on Aug 13, 2026

Security: deferred TAR hardlinks can escape through a later symlink

Status: Open.

#852 In indaco/malt;

· rustytrees opened on Aug 13, 2026

Security: macOS helper commands can be replaced through PATH

Status: Open.

#851 In indaco/malt;

· rustytrees opened on Aug 13, 2026

Security: native read and inreplace paths can import files from outside the prefix

Status: Open.

#850 In indaco/malt;

· rustytrees opened on Aug 13, 2026

Security: cask binary and font sources can follow symlinks outside extraction roots

Status: Open.

#849 In indaco/malt;

· rustytrees opened on Aug 13, 2026

Security: declarative post-install output can inject terminal control sequences

Status: Open.

#848 In indaco/malt;

· rustytrees opened on Aug 13, 2026

Security: sandboxed post-install commands can read arbitrary user files

Status: Open.

#847 In indaco/malt;

· rustytrees opened on Aug 13, 2026

test-one does not execute integration test blocks

Status: Open.

#839 In indaco/malt;

· rustytrees opened on Aug 12, 2026

Bundle install is very slow

enhancementNew feature or requestNew feature or request

Status: Open.

#821 In indaco/malt;

· enocla opened on Aug 10, 2026